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Summary 

Facilities  handling  large  amounts  of  potentially  hazardous  chemicals  (i.e., 
chemical  facilities)  might  be  of  interest  to  terrorists,  either  as  targets  for  direct  attacks 
meant  to  release  chemicals  into  the  community  or  as  a  source  of  chemicals  for  use 
elsewhere.  Because  few  terrorist  attacks  have  been  attempted  against  chemical 
facilities  in  the  United  States,  the  risk  of  death  and  injury  in  the  near  future  is 
estimated  to  be  low,  relative  to  the  likelihood  of  accidents  at  such  facilities  or  attacks 
on  other  targets  using  conventional  weapons.  For  any  individual  facility,  the  risk  is 
very  small,  but  risks  may  be  increasing  with  potentially  severe  consequences  for 
human  health  and  the  environment.  Available  evidence  indicates  that  many  chemical 
facilities  may  lack  adequate  safeguards. 

Two  federal  environmental  laws  enacted  in  1986  and  1990  require  chemical 
facility  planning  to  protect  the  general  public  from  accidental  releases  of  hazardous 
chemicals.  However,  neither  law  explicitly  addresses  terrorism.  After  9/11, 
Congress  enacted  legislation  that  requires  the  Department  of  Homeland  Security 
(DHS)  to  analyze  vulnerabilities  and  to  suggest  security  enhancements  for  “critical 
infrastructure.”  The  Public  Health  Security  and  Bioterrorism  Preparedness  and 
Response  Act  of  2002  (P.L.  107-188)  and  the  Maritime  Transportation  Security  Act 
(MTSA,  P.L.  107-295)  require  vulnerability  assessments,  security  plans,  and  incident 
response  plans  for  some  chemical  facilities  that  supply  drinking  water  or  are  located 
in  ports.  Many  other  chemical  facilities  remain  unregulated. 

Congress  has  many  legislative  options.  For  example,  it  might  rely  on  existing 
efforts  in  the  public  and  private  sectors  to  improve  chemical  site  security  over  time. 
Additional  information  about  the  potential  risks  and  benefits  of  enhancing  security 
could  be  collected  to  permit  better  targeting  of  existing  programs.  Alternatively, 
Congress  could  expand  existing  environmental  planning  requirements  for  chemical 
facilities  to  require  consideration  of  terrorism.  DHS  could  be  directed  to  oversee 
security  enhancement  at  potentially  dangerous  facilities.  Or,  Congress  might  enact 
legislation  to  reduce  risks,  either  by  “hardening”  defenses  against  terrorists,  for 
example  by  increasing  security  patrols,  or  by  requiring  industries  to  consider  use  of 
safer  chemicals ,  procedures ,  or  processes .  Restricting  terrorists  ’  access  to  information 
might  be  a  least-cost  approach  to  reducing  risks,  but  it  would  also  limit  public  access 
to  information  about  risks  to  which  they  might  be  exposed,  and  reduce  accountability 
of  facility  owners.  Policy  makers  face  three  key  issues:  how  to  balance  the  risks  and 
benefits  of  public  disclosure;  how  to  weigh  the  relative  importance  of  diverse  risks; 
and  whom  to  hold  responsible  for  achieving  results. 

In  the  108*  Congress,  the  Senate  Committee  on  Environment  and  Public  Works 
reported  a  bill  (S.  994)  that  would  have  required  vulnerability  assessments  and 
security  plans  for  designated  facilities.  A  competing  proposal  (S.  157),  in  addition 
to  vulnerability  assessments  and  security  plans,  would  have  required  risk  reduction 
through  use  of  “inherently  safer”  technologies,  if  practicable.  Whether  similar 
proposals  will  be  introduced  into  the  109*  Congress  is  unclear,  in  part  because 
committee  jurisdiction  over  this  issue  may  change  in  either  the  House  or  the  Senate. 
This  report  will  be  updated  as  warranted  by  congressional  activity. 
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Introduction 

The  potential  harm  to  public  health  and  the  environment  from  a  large  release  of 
hazardous  chemicals  has  long  concerned  the  U.S.  Congress.  The  sudden,  accidental 
release  in  December  1984  of  methyl  isocyanate  in  an  industrial  incident  at  the  Union 
Carbide  plant  in  Bhopal,  India,  and  the  attendant  loss  of  thousands  of  lives  and 
widespread  injuries  spurred  legislative  proposals  to  reduce  the  risk  of  chemical 
accidents  in  the  United  States.  For  example,  federal  environmental  laws  were 
enacted  in  1986  and  1990  to  mitigate  and  reduce  the  risk  of  accidental  releases  of 
hazardous  chemicals  from  manufacturing  facilities,  processing  plants,  and  storage 
tanks.  (These  laws  are  discussed  below.)  The  Hazardous  Materials  Transportation 
Act  of  1975  was  passed  to  protect  the  public  and  environment  in  the  event  of  an 
accident  during  transportation  of  chemicals.  Other  federal  laws  coordinate 
preparedness  planning  and  response  to  significant  chemical  spills  (e.g.,  the 
Comprehensive  Environmental  Response,  Compensation,  and  Liability  Act). 

The  threat  of  terrorism  manifested  on  September  11  prompted  renewed 
congressional  attention  to  the  potential  risks  to  public  health  and  the  environment 
posed  by  facilities  handling  large  quantities  of  hazardous  chemicals.  Congress 
addressed  chemical  facility  security  when  it  enacted  legislation  establishing  the 
Department  of  Homeland  Security  (DHS;  P.L.  107-296).  The  law  requires  analysis 
of  vulnerabilities  and  suggestions  for  security  enhancements  for  “critical 
infrastructure.”  The  Public  Health  Security  and  Bioterrorism  Preparedness  and 
Response  Act  of  2002  (P.L.  107-188)  and  the  Maritime  Transportation  Security  Act 
(MTSA,  P.L.  107-295)  require  vulnerability  assessments,  security  plans,  and  incident 
response  plans  for  some  chemical  facilities  that  supply  drinking  water  or  are  located 
in  ports.  Many  other  chemical  facilities  remain  unregulated  with  respect  to 
terrorism.^  Thus,  the  109*  Congress  is  likely  to  continue  discussions  about  the  risks 
and  consequences  of  potential  terrorist  attacks  on  chemical  facilities  and  possible 
actions  the  federal  government  might  take  to  prevent  or  reduce  them. 

This  report  provides  background  information  and  summarizes  issues  relevant 
to  existing  and  proposed  requirements  aimed  at  reducing  risks  to  the  general  public 
of  exposure  to  hazardous  chemicals  as  a  result  of  terrorist  acts  at  U.S.  chemical 
production,  processing,  or  storage  facilities.^  It  considers  the  likelihood  and  severity 


*  There  is  no  universally  accepted  definition  of  “terrorism.”  Various  definitions  are 
discussed  in  CRS  Issue  Brief  IB  10119,  Terrorism  andNational  Security:  Issues  and  Trends. 

^  This  includes  facilities  that  store  chemicals  incident  to  use  (such  as  certain  water  treatment 
facilities),  but  not  incident  to  transport.  For  information  on  the  security  of  other  types  of 

(continued...) 
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of  harm  that  might  result  from  terrorist  attacks  on  chemical  facilities,  as  well  as  from 
illicit  use  of  such  facilities  to  gain  access  to  hazardous  chemicals  (or  to  precursor 
chemicals  that  can  be  used  to  produce  hazardous  chemicals).  Federal  requirements 
for  contingency  planning  and  responding  to  chemical  emergencies  after  they  occur 
are  not  the  focus  of  this  report.  In  addition,  it  does  not  consider  hazardous  materials 
transport  (or  storage  incidental  to  transport). 

The  report  first  describes  the  range  of  terrorist  acts  that  might  threaten  chemical 
facilities  and  summarizes  publicly  available  information  relevant  to  risks:  recent 
trends  in  terrorist  activity,  including  chemical  use  by  terrorists;  expert  estimates  of 
the  harm  that  might  be  inflicted  through  chemical  terrorism;  and  assessments  of  the 
vulnerability  of  chemical  facilities.  The  next  section  of  the  report  discusses  existing 
federal  mandates  and  incentives  for  reducing  risks  of  accidental  releases  from 
chemical  facilities.  The  remainder  of  the  report  summarizes  recent  Administration 
and  private  sector  initiatives  to  improve  chemical  site  security;  analyzes  policy 
options  and  key  issues;  and  describes  legislation  in  the  109*  Congress. 

Risks  of  Terrorism  at  Chemicai  Faciiities 

Nature  of  Hazards.  Potential  terrorist  acts  against  chemical  facilities  might 
be  classified  roughly  into  two  categories:  direct  attacks  on  facilities  or  chemicals  on 
site,  or  efforts  to  use  business  contacts,  facilities,  and  materials  (e.g.,  letterhead, 
telephones,  computers,  etc.)  to  gain  access  to  potentially  harmful  materials.  In  either 
case,  terrorists  may  be  employees  (saboteurs)  or  outsiders,  acting  alone  or  in 
collaboration  with  others.  In  the  case  of  a  direct  attack,  traditional  or  nontraditional 
weapons  may  be  employed,  including  explosives,  incendiary  devices,  firearms, 
airplanes,  computer  programs,  or  weapons  of  mass  destruction  (nuclear,  radiological, 
chemical,  or  biological). 

In  obtaining  chemicals,  a  terrorist’s  intent  may  be  their  use  as  weapons  or  to 
make  weapons,  including  but  not  limited  to  explosives,  incendiaries,  poisons,  and 
caustics.  Access  to  chemicals  might  be  gained  by  physically  entering  a  facility  and 
stealing  supplies,  or  by  using  legitimate  or  fraudulent  credentials  (e.g.,  company 
stationary,  order  forms,  computers,  telephones  or  other  resources)  to  order,  receive, 
or  distribute  chemicals. 

Recent  Trends  in  Overall  Terrorist  Activities.  According  to  February 
2003  testimony  by  the  Director  of  the  Federal  Bureau  of  Investigation  (FBI)  to  the 
U.S.  Senate,  there  were  353  known  or  suspected  acts  of  terrorism  (including  terrorist 
acts  by  Americans)  perpetrated  within  the  United  States  between  1980  and  2001.^ 
Only  a  few  incidents  involved  chemical  facilities.  Attacks  during  the  1990s  claimed 


^  (...continued) 

facilities,  see  the  CRS  Current  Legislative  Issues  topic  Homeland  Security,  especially  the 
section  entitled.  Critical  Infrastructure  Security  at  [http://www.congress.gov/erp/legissues/ 
html/isdhs5.html],  visited  Feb.  4,  2005. 

^  Mueller,  Robert  S.,  Ill,  Director,  Federal  Bureau  of  Investigation.  Testimony  before  the 
Senate  Select  Committee  on  Intelligence  ,  Feb.  11,  2003,  at  [http://www.intelcenter.com/ 
resource/2003/mueller.pdf],  visited  Feb.  4,  2005. 
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182  lives  and  injured  over  1,932  individuals."^  In  comparison,  during  the  1980s, 
although  there  were  many  more  terrorist  or  suspected  terrorist  incidents,  only  23 
people  were  killed  and  105  were  injured.^  Thus,  although  the  total  number  of 
terrorist  acts  in  the  United  States  declined  toward  the  end  of  the  twentieth  century, 
the  casualties  due  to  terrorism  increased. 

The  same  trends  have  been  evident  internationally,  although  there  is 
considerable  variation  from  year  to  year.®  The  year  2003  had  208  international 
terrorist  attacks  on  noncombatants,  a  few  more  than  2002,  but  42%  fewer  than  in 
2001.’ 

In  terms  of  U.S.  casualties  due  to  international  terrorism,  2001  is  the  most  costly 
year  on  record,  with  2,689  people  killed.^  As  noted  by  the  FBI  Executive  Assistant 
Director  for  Counterterrorism  and  Counterintelligence,  the  attack  of  September  11, 
2001,  “marked  a  dramatic  escalation  in  a  trend  toward  more  destructive  terrorist 
attacks  which  began  in  the  1980s.”® 

The  September  1 1  attack  also  reflected  a  trend  toward  more  indiscriminate 
targeting  among  international  terrorists.  The  vast  majority  of  the .  ..victims 
of  the  attack  were  civilians.  In  addition,  the  attack  represented  the  first 
known  case  of  suicide  attacks  carried  out  by  international  terrorists  in  the 
United  States.  The  September  1 1  attack  also  marked  the  first  successful 
act  of  international  terrorism  in  the  United  States  since  the  vehicle 
bombing  of  the  World  Trade  Center  in  February  1993.^° 

There  were  725  persons  killed  in  2002  and  625  persons  (35  U.S.  citizens)  in  2003." 

Other  potentially  important  trends  identified  by  intelligence  agencies  include: 


The  Oklahoma  City  bombing  of  the  federal  building  in  1995  accounts  for  168  of  the  182 
deaths  during  the  decade. 

^  Counterterrorism  Division,  Counterterrorism  Threat  Assessment  and  Warning  Unit, 
Federal  Bureau  of  Investigation,  Department  of  Justice.  Terrorism  in  the  United  States 
1999:  30  Years  of  Terrorism,  A  Special  Retrospective  Edition,  p.  16. 

®  U.S.  Department  of  State.  2004.  Patterns  of  Global  Terrorism  2003.  Revised  June  22, 
2004.  [http://www.state.gOv/s/ct/rls/pgtrpt/2003/],  visited  Sept.  20,  2004. 

"Ibid. 

*  Ibid.  p.  180.  The  anthrax  killings  may  or  may  not  be  found  to  meet  the  FBI  definition  of 
terror,  depending  on  whether  the  criminal  intended  to  further  political  or  social  objectives. 

®  Watson,  Dale  L.,  Executive  Assistant  Director,  Counterterrorism  and  Counterintelligence, 
Federal  Bureau  of  Investigation.  Statement  for  the  Record  on  the  terrorist  threat  confronting 
the  United  States  before  the  Senate  Select  Committee  on  Intelligence.  Feb.  6,  2002. 
[http://www.fbi.gOv/congress/congress02/watson020602.htm],  visited  Feb.  4,  2005. 

'“Ibid,  p.  1. 

"  U.S.  Department  of  State.  2004.  The  Year  in  Review  (Revised),  at  [http://www.state. 
gov/s/ct/rls/pgtrpt/2003/33771.htm],  visited  Sept.  20,  2004. 
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•  an  increase  in  activity  by  loosely  affiliated  extremists,  both 
domestically  and  internationally;  and 

•  the  propensity  of  such  groups  to  focus  on  producing  mass 
casualties/^’ 

Trends  in  Chemical  Terrorism.  With  respect  to  chemical  and  biological 
terrorism,  hoaxes  and  unsuccessful  attempts  by  terrorists  to  use  chemicals  increased 
throughout  the  1990s.  Loosely  affiliated  terrorist  groups,  in  particular,  have 
demonstrated  a  growing  interest  in  chemical  weapons  and  other  weapons  of  mass 
destruction,  but  explosives  are  still  the  most  frequently  employed  weapons.'"^ 

During  the  1990s,  both  international  and  domestic  terrorists  attempted  to  use 
explosives  to  release  chemicals  from  manufacturing  and  storage  facilities.  Most  of 
these  attempts  were  abroad  in  war  zones  such  as  Croatia,  including  attacks  on  a  plant 
producing  fertilizer,  carbon  black,  and  light  fraction  petroleum  products ;  other  plants 
producing  pesticides;  and  a  pharmaceutical  factory  using  ammonia,  chlorine,  and 
other  hazardous  chemicals.  All  of  these  facilities  were  close  to  population  centers. 
In  the  United  States,  there  were  at  least  two  instances  during  the  late  1990s  when 
criminals  attempted  to  cause  releases  of  chemicals  from  facilities.  One  involved  a 
large  propane  storage  facility,  and  the  other  a  gas  refinery.'^ 

Evidence  that  U.S.  chemical  facilities  may  be  used  by  terrorists  to  gain  access 
to  chemicals  also  exists.  For  example,  one  of  the  1993  World  Trade  Center  bombers, 
Nidal  Ayyad,  became  a  naturalized  U.S.  citizen,  graduated  from  Rutgers  University, 
and  worked  as  a  chemical  engineer  at  Allied  Signal,  from  which  he  used  company 
stationery  to  order  chemical  ingredients  to  make  the  bomb.  According  to  a  U.S. 
Prosecutor  in  the  case  against  the  bombers,  though  “some  suppliers  balked  when  the 
order  came  from  outside  official  channels,  when  the  delivery  address  was  a  storage 
park,  or  when  [a  co-conspirator]  tried  to  pay  for  the  chemicals  in  cash,”  others  did 
not.^'’  Moreover,  testimony  at  the  trial  of  the  bombers  indicated  that  they  had 
successfully  stolen  cyanide  from  a  chemical  facility  and  were  training  to  introduce 


Ibid. 

Counterterrorism  Division,  Counterterrorism  Threat  Assessment  and  Warning  Unit, 
Federal  Bureau  of  Investigation,  Department  of  Justice.  Terrorism  in  the  United  States 
1999:  30  Years  of  Terrorism,  A  Special  Retrospective  Edition,  p.  25. 

Ibid.,  pp.  17,  25. 

Department  of  Justice.  Assessment  of  the  Increased  Risk  of  Terrorist  or  Other  Criminal 
Activity  Associated  with  Posting  Off-Site  Consequence  Analysis  Information  on  the  Internet. 
April  18,  2000.  p.  23-24. 

Parachini,  John  V.  “The  World  Trade  Center  Bombers  (1993).”  In:  Jonathan  B.  Tucker 
(ed.)  2000.  Toxic  Terror:  assessing  terrorist  use  of  chemical  and  biological  weapons. 
Cambridge,  MA:  MIT  Press,  p.  190.  Citing  the  summation  statement  of  Henry  J.  DePippo, 
Prosecutor,  United  States  of  America  v.  Mohammad  A.  Salamehet  al.,  S593CR.180  (KTD), 
Feb,  16,  1994, p.  8435-8439. 
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it  into  the  ventilation  systems  of  office  buildings/^  More  recently,  chemical  trade 
publications  reportedly  were  found  in  al  Qaeda  hideaways.'* 

Predicted  Risks  of  Chemicai  Terrorism.  The  validity  of  any  risk 
assessment  depends  on  how  much  is  known  about  the  hazard,  risks  (probabilities), 
adverse  effects,  events  and  conditions  that  lead  to  or  modify  adverse  effects  or  risks, 
and  populations  or  environments  that  influence  or  experience  adverse  effects.  The 
most  accurate,  and  therefore  the  most  useful,  risk  assessments  generally  are  for 
familiar,  frequently  occurring  hazards  and  events  with  impacts  that  are  experienced 
with  some  regularity,  such  as  severe  storms  or  floods.  In  contrast,  the  risk  of  terrorist 
activity  is  unfamiliar  (at  least  in  the  United  States),  rarely  experienced,  and  likely  to 
vary  significantly  over  time,  depending  on  rather  unpredictable  social  and  political 
phenomena. 

The  risk  of  terrorism  targeting  chemical  facilities  is  particularly  difficult  to 
assess  for  at  least  three  reasons: 

•  There  are  few  prior  examples  of  terrorists  targeting  chemical 
facilities; 

•  Numerous  factors  theoretically  may  increase  or  decrease  risks;  and 

•  Interactions  among  factors  influencing  risks  are  dynamic  and 
changing. 

In  part,  these  difficulties  stem  from  the  nature  of  terrorism  and  the  terrorists’ 
deliberate  efforts  to  do  what  is  least  expected  —  that  is,  to  defy  prediction.  For  these 
reasons,  most  experts  have  not  tried  to  quantify  risks;  existing  analyses  of  chemical 
terrorism  risks  in  the  open  literature  are  speculative  and  qualitative.'® 

Until  the  mid  to  late  1990s,  reports  focused  on  the  acquisition  and  use  of 
chemical  weapons,  such  as  sarin  or  mustard  gas.  One  of  the  most  comprehensive  of 
these  reports  was  a  1995  review  of  the  open  literature  on  terrorism  that  was  prepared 
for  the  Canadian  Security  Intelligence  Service.^"  According  to  this  review  of  the 
literature,  “[tjhose  authors  who  have  speculated  about  the  future  terrorist  use  of 
chemical  agents  in  particular  have  generally  rated  its  likelihood  as  quite  high.”^' 


Ibid. 

Bond,  Christopher.  Statement  on  S.  2579.  Congressional  Record,  Daily  Edition,  June  5, 
2002,  p.  S5043. 

Computerized  databases  on  terrorist  acts  offer  considerable  promise  for  risk  analysts  who 
have  access.  Nevertheless,  the  unpredictable  nature  of  individuals  and  of  the  social  and 
political  forces  that  shape  them  over  time  will  continue  to  challenge  predictions  about  future 
events. 

20  Purver,  Ron.  Chemical  and  biological  terrorism:  The  threat  according  to  the  open 
literature,.  June  1995.  Canadian  Security  Intelligence  Service,  [http://www.csis- 
scrs.gc.ca/eng/miscdocs/tabintr_e.html],  visited  Feb.  4,  2005. 

Ibid,  Chemical  Terrorism,  p.  28.  This  prediction  about  the  use  of  chemical  agents 
contrasts  with  conventional  wisdom  that  the  probability  of  chemical  weapon  use  is  relatively 

(continued...) 
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According  to  some,  the  risk  also  appears  to  be  increasing.  Many  experts  today 
believe  that  factors  that  might  have  inhibited  proliferation  and  use  of  chemicals  as 
weapons  in  the  past  are  eroding.  For  example,  some  experts  hypothesized  several 
years  ago  that  the  combination  of  chemical  and  strategic  skills  necessary  to  create  and 
deploy  chemical  weapons  would  prevent  the  lone  terrorist  from  using  them.^^ 
Security  experts  now  believe  that  lack  of  personal  expertise  no  longer  limits  chemical 
weapon  use,  because  there  is  a  tendency  for  terrorists  with  similar  extreme  views  to 
affiliate  loosely  with  others  with  complementary  skills  and  abilities.  Moreover,  the 
rising  level  of  education  worldwide  means  that  more  people  have  the  requisite 
training  in  chemical  engineering,  and  the  Internet  has  simplified  communications, 
training,  and  cooperation  within  geographically  dispersed  terrorist  groups. 

Others  have  argued  that  chemical  attacks  would  be  unlikely,  due  to  the 
difficulties  of  producing  and  effectively  delivering  chemical  agents  in  sufficient 
amounts  to  produce  mass  casualties. However,  while  this  may  be  true  with  regard 
to  military  use  on  a  large  scale,  where  weapons  are  delivered  by  advanced  systems, 
it  is  not  necessarily  relevant  to  terrorists  who  may  have  more  limited  ambitions.  A 
1999  report  by  GAO  summarized  the  situation  — 

...  many  conflicting  statements  have  been  made  in  public  testimony  before 
Congress  ...  concerning  the  ease  or  difficulty  with  which  terrorists  could 
effectively  disseminate  a  chemical  or  biological  agent  on  U.S.  soil  and  cause 
mass  casualties.^'* 

GAO  studied  the  threat  and  concluded  that  the  ease  or  difficulty  for  terrorists  to  cause 
more  than  1 ,000  casualties  depends  on  the  chemical  or  biological  agent  selected.  The 
report  stated  — 

Experts  from  the  scientific,  intelligence,  and  law  enforcement  communities  told 
us  that  terrorists  do  not  need  sophisticated  knowledge  or  dissemination  methods 
to  use  toxic  industrial  chemicals  such  as  chlorine.  In  contrast,  terrorists  would 
need  a  relatively  high  degree  of  sophistication  to  successfully  cause  mass 
casualties  with  some  other  chemical  and  most  biological  agents. 

On  the  other  hand. 


(...continued) 

small.  The  conventional  prediction,  however,  focuses  on  military  use  of  chemical  weapons 
in  future  wars  among  nations,  rather  than  on  chemical  use  by  terrorists. 

Ibid.,  p.  29. 

Purver,  p.  5-13. 

^  U.S.  Congress.  General  Accounting  Office.  Combating  Terrorism:  Need  for 
Comprehensive  Threat  and  Risk  Assessments  of  Chemical  and  Biological  Attacks. 
GAO/NSIAD-99-163.  Sept.  1999.  p.  1. 
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“[tjerrorists  with  less  sophistication  could  make  a  chemical  or  biological  weapon 
and  disseminate  agents,  hut  these  would  he  less  likely  to  cause  mass 
casualties.”^® 

Other  factors  that  might  have  inhibited  chemical  use  by  some  terrorists  in  the 
past  might  not  apply  to  loosely  affiliated  terrorist  groups.  For  example,  some  experts 
argue  that  terrorists  supported  by  nation-states  have  been  reluctant  to  use  chemical 
weapons  for  fear  of  offending  other  nations  and  neutral  parties,  particularly  if  the 
sponsors  were  signatories  of  the  Chemical  Weapons  Convention.^'’  Another  possible 
deterrent  to  chemical  use,  fear  of  retaliation,  probably  is  of  little  concern  to  attackers 
with  no  identifiable  homeland  or  headquarters.  Lack  of  a  homeland  might  also  lessen 
concern  about  environmental  damage  that  may  be  associated  with  chemical 
production.  Finally,  one  must  presume  that  occupational  safety  would  be  of  limited 
concern  to  terrorists  who  are  not  accountable  to  a  government,  and  who  are  willing 
to  sacrifice  their  own  lives  for  a  religious,  political,  or  social  cause. 

However,  many  experts  believe  that  the  relative  risk  of  terrorism  involving 
chemical  weapons  remains  small.  This  point  was  stressed  by  John  V.  Parachini,  a 
senior  associate  at  the  Center  for  Nonproliferation  Studies,  Monterey  Institute  of 
International  Studies  at  a  1999  hearing  before  the  U.S.  House  of  Representatives, 
Committee  on  Government  Reform,  Subcommittee  on  National  Security,  Veterans 
Affairs,  and  International  Relations.  Referring  to  the  risk  of  any  use  of  chemical  or 
biological  weapons  he  stated: 

...  attacks  with  chemical  and  hiological  weapons  are  strikingly  infrequent  and  the 
number  of  fatalities  and  casualties  are  far  lower  than  those  caused  by 
conventional  explosives.  According  to  an  analysis  of  105  U.S.  incidents  featured 
in  the  Monterey  Institute  database  from  1900  to  1998,  only  one  fatality  resulted 
from  a  [chemical  or  biological  weapon]  attack.  This  incident  involved  a  1973 
assassination  of  an  Oakland,  California  school  superintendent  by  the  Symbionese 
Liberation  Army.^’ 

Severity  of  Harm.  It  is  generally  agreed  that  chemical  agents  are  likely  to  be 
the  least  lethal  of  the  three  “weapons  of  mass  destruction.”  In  part,  this  judgment 
reflects  the  difficulty  of  producing  and  delivering  large  quantities  of  a  lethal  chemical 
to  the  target  area  prior  to  release.  On  the  other  hand,  industrial  chemicals  and 
pesticides  are  readily  available  for  purchase,  and  are  stored  in  large  quantities  in 
thousands  of  locations  throughout  the  United  States,  often  near  population  centers. 
A  key  question  for  chemical  facilities  then  is  “How  much  damage  could  terrorists  do 
using  existing  stationary  chemical  manufacturing,  processing,  distribution,  and 
storage  facilities?” 


“  Ibid.,  p.  3. 

Purver,  p.  28. 

U.S.  Congress.  House.  Committee  on  Government  Reform.  Subcommittee  on  National 
Security,  Veterans’  Affairs,  and  International  Relations.  Combating  Terrorism:  Assessing 
the  Threat.  Hearings,  106*  Cong.,  U‘  Sess.,  Oct.  20,  1999.  Washington,  U.S.  Govt.  Print. 
Off.,  2000,  p.  55-56. 
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There  are  two  key  sources  of  information  for  answering  this  question:  accident 
reports  and  hazard  assessments  conducted  by  facility  personnel  or  outside  experts. 
There  is  no  comprehensive  database  for  either  kind  of  information,^*  but  various 
groups  have  used  publicly  available  data  to  estimate  hazard  potential,  usually  limited 
to  accidental  releases  of  chemicals  from  chemical  facilities. 

A  1998  report  by  the  U.S.  Public  Interest  Research  Group  (US  PIRG)  and  the 
National  Environmental  Law  Center,  Too  Close  to  Home:  Chemical  Accident  Risks 
in  the  United  States,  addressed  the  distribution  of  chemical  facilities  in  the  United 
States  relative  to  population  distribution.  It  stated  that  “more  than  41  million 
Americans  live  within  range  of  a  toxic  cloud  that  could  result  from  a  chemical 
accident  at  a  facility  located  in  their  home  zip  code.”^®  Those  41  million  Americans 
live  in  zip  codes  that  contain  manufacturing  companies  with  “vulnerable  zones” 
extending  more  than  three  miles  from  the  facility,  the  report  states.  A  “vulnerable 
zone”  is  the  geographic  area  that  could  be  affected  by  the  worst  possible  accident  at 
a  facility. According  to  the  report,  the  estimate  of  41  million  Americans  at  risk  may 
underestimate  the  hazard,  because  it  was  based  on  “assumptions  about  facility  and 
atmospheric  conditions  that  would  lead  to  small  vulnerability  zones.”*'  To  produce 
the  estimate,  the  study  author  stated  that  he  used  standard  methodology  used  by  the 
U.S.  Environmental  Protection  Agency  (EPA)  and  data  on  chemical  storage  from 
EPA’s  1995  Toxics  Release  Inventory,  a  database  of  routine  releases  of  industrial 
chemicals  from  manufacturing  facilities. 

Hazard  estimates  by  James  C.  Belke,  an  EPA  employee  in  the  Chemical 
Emergency  Preparedness  and  Prevention  Office,  are  more  detailed.  Based  on  a 
preliminary  analysis  of  approximately  15,000  facility  risk  management  plans  for 
chemical  facilities  that  were  filed  under  the  Clean  Air  Act,  Section  112(r)  before 
September  25,  2000,**  Belke  concluded  that  the  median  distance  from  a  facility  to 
the  outer  edge  of  its  vulnerable  zone  is  1.6  miles  in  the  case  of  toxic  worst  case 
scenarios,  and  0.4  miles  for  flammable  worst  case  scenarios.  However,  many 
facilities  reported  vulnerable  zones  potentially  extending  14  miles  from  the  facility 
(primarily  for  releases  in  urban  areas  of  chlorine  stored  in  90-ton  rail  tank  cars)  and 
25  miles  (for  releases  in  rural  terrain  of  chlorine  stored  in  90-ton  rail  tank  cars). 
Other  chemicals  for  which  reported  vulnerable  zones  equaled  or  exceeded  25  miles 


**  The  most  comprehensive,  but  still  incomplete,  listing  of  chemical  spills  and  releases  is 
kept  by  the  National  Response  Center  and  available  on  the  Internet  at  [http://www. 
nrc.uscg.mil/foia.html],  visited  Feb.  4,  2005. 

Laplante,  Allison.  1998.  Too  Close  To  Home:  A  Report  on  Chemical  Accident  Risks  in 
the  United  States.  U.S.  Public  Interest  Research  Group.  [http://uspirg.org/uspirg.asp?id2= 
5067&id3=USPIRG&],  visited  Sept.  20,  2004. 

*°  “Vulnerable  zones”  apply  to  facilities  required  to  prepare  risk  management  plans  under 
the  Clean  Air  Act,  Section  1 12(r).  By  definition,  people  within  the  zone  could  (but  would 
not  necessarily)  sustain  serious  injuries  from  short-term  exposures. 

*'  Laplante,  Executive  Summary,  p.  2. 

**  Belke,  James  C.  Chemical  accident  risks  in  U.S.  industry  —  A  preliminary  analysis  of 
accident  risk  data  from  U.S.  hazardous  chemical  facilities,  Sept.  25,  2000,  p.  24,  at 
[http://www.epa.gov/swercepp/pubs/stockholmpaper.pdf],  visited  Sept.  20,  2004. 
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include  anhydrous  ammonia,  hydrogen  fluoride,  sulfur  dioxide,  chlorine  dioxide, 
oleum  (fuming  sulfuric  acid),  sulfur  trioxide,  hydrogen  chloride,  hydrocyanic  acid, 
phosgene,  propionitrile,  bromine,  and  acrylonitrile.) 

Belke  found  the  median  population  “affected”  in  a  worst  case  accident  was  15 
people,  for  a  flammable  substance,  while  the  median  for  toxic  substances  was  1,500 
people. (“Affected”  means  potentially  exposed.  It  is  highly  unlikely  that  all  people 
within  the  vulnerable  zone  would  be  exposed  due  to  a  single  release.  However, 
anyone  within  the  zone  could  be  in  the  path  of  the  chemical  released,  given  certain 
environmental  conditions.)  Further  EPA  analysis  of  risk  management  plans 
submitted  by  facilities  handling  chemicals  covered  by  the  CAA  Section  1 12  revealed 
that  at  least  123  plants  reported  a  worst-case  scenario  with  a  vulnerability  zone 
containing  more  than  a  million  people. The  analysis  also  found  that  more  than  700 
plants  could  threaten  100,000  people,  and  at  least  3,000  facilities  could  threaten 
10,000  people  in  the  vicinity. 

The  Department  of  Justice  (DOJ)  analyzed  EPA  data  and  concluded  that  among 
facilities  submitting  risk  management  plans  to  EPA,  more  than  7,000  facilities 
projected  worst  case  scenarios  for  toxic  substances  that  could  potentially  affect  more 
than  1,000  people. Almost  1,700  facilities  reported  the  possibility  that  a  less 
extreme  accident  might  potentially  affect  more  than  1,000  people. 

Histories  of  actual  accidents  (as  opposed  to  hypothetical  worst-case  scenarios) 
for  facilities  submitting  risk  management  plans  to  EPA  prior  to  October  21,  1999, 
were  summarized  in  a  working  paper  prepared  by  the  Center  for  Risk  Management 
and  Decision  Processes  at  the  Wharton  School,  University  of  Pennsylvania.^*  Of 
14,500  reporting  facilities,  1,145  reported  1,913  accidents  between  June  21, 1994  and 
June  20, 1999.  Of  the  1 , 145  facilities  reporting  accidents,  346  facilities  had  multiple 
accidents.  Half  of  the  chemicals  for  which  risk  management  planning  is  required 
under  the  CAA  Section  112(r)  were  involved  in  accidents.  Half  of  the  accidents 
resulted  in  reported  injuries  to  workers.  Accidents  caused  a  reported  1,897  injuries 


Belke,  p.  26. 

Belke,  J.  (2001),  “Chemical  Accident  Risks  in  U.S.  Industry  -  A  preliminary  analysis  of 
accident  risk  data  from  U.S.  hazardous  chemical  facilities”,  Proceedings  of  the  10* 
International  Symposium  on  Loss  Prevention  and  Safety  Promotion  in  the  Process 
Industries,  Stockholm,  Sweden,  Pasman,  Fredholm,  and  Jacobson  (eds.),  Elsevier 
Science  B.V.  —  Note:  This  does  not  mean  that  more  than  a  million  people  would  be 
exposed  and  injured,  but  rather  that,  depending  on  wind  direction  and  other  factors,  some 
portion  of  the  population  in  the  zone  might  be  exposed  and  injured. 

Ibid. 

Department  of  Justice,  p.  13. 

Ibid. 

Kleindorfer,  Paul  R.,  Harold  Feldman,  and  Robert  A.  Lowe.  Accident  Epidemiology  and 
the  U.S.  Chemical  Industry:  Preliminary  Results  fromRMP*Info.  Working  Paper  00-01-15. 
Center  for  Risk  Management  and  Decision  Processes,  The  Wharton  School,  University  of 
Pennsylvania.  Revised  March  6,  2000.  27  p.  [http://opim.wharton.upenn.edu/risk/ 

epi_downloads.html],  visited  Sept.  20,  2004. 
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and  33  deaths  to  employees,  141  injuries  and  no  deaths  to  non-employees.  No  deaths 
were  reported  off-site.  However,  over  200,000  community  residents  were  involved 
in  evacuations  and  shelter-in-place  incidents. 

Further  analysis  by  the  Wharton  group  revealed  that  the  risk  of  accidental 
chemical  releases  and  of  worker  injuries  or  property  damage  increased  with  the  size 
of  the  facility  (from  10  to  1 ,000  full-time  equivalent  employees  or  FTEs)."^°  Note  that 
this  refers  to  accidents  of  any  kind,  not  to  worst-case  events.  In  addition,  facilities 
reporting  that  they  handled  large  amounts  and  many  types  of  chemicals  had  much 
higher  accident  rates  than  facilities  handling  smaller  amounts  and  fewer  types  of 
chemicals.  The  probability  that  a  facility  had  experienced  a  chemical  accident  of  any 
size  approached  100%  for  the  very  largest  chemical  manufacturers.  Toxic  chemicals 
were  more  strongly  associated  with  worker  injuries,  while  flammable  chemicals  were 
more  strongly  associated  with  property  damage.  No  regional  trends  in  accident  rates 
were  discovered  (i.e.,  facilities  in  various  geographical  regions  had  similar  accident 
rates). 

In  contrast  to  the  above  figures,  which  all  were  based  on  hypothetical  or  actual 
accidents  described  in  risk  management  plans,  the  Washington  reported  March 
12,  2002,  that  a  classified  study  conducted  by  the  U.S.  Army  Surgeon  General  dated 
October  29,  2001,  found  that  a  terrorist  attack  resulting  in  a  chemical  release  in  a 
densely  populated  area  could  injure  or  kill  as  many  as  2.4  million  people.'*' 
According  to  the  news  article,  the  study  found  “even  middle-range  casualty  estimates 
from  a  chemical  weapons  attack  or  explosion  of  a  toxic  chemical  manufacturing  plant 
are  as  high  as  903,400  people.”'*^  The  worst-case  estimate  of  2.4  million  casualties 
from  a  chemical  release  was  roughly  half  the  surgeon  general’s  estimate  for 
casualties  due  to  widespread  use  of  biological  weapons,  according  to  the  report.  The 
Army  Surgeon  General  recently  explained  that  the  estimate  of  2.4  million  casualties 
is  of  “the  number  of  people  who  might  request  medical  treatment  during  a  total 
release  of  a  large  industrial  chemical  manufacturing  plant,  in  a  densely  populated 
area,  and  under  ideal  weather  conditions  for  maximum  exposure.”'*^  As  in  most 
studies  of  this  kind,  some  question  the  magnitude  and  likelihood  of  the  casualty 
estimates. 

In  2004,  the  Department  of  Homeland  Security  used  EPA  data  to  estimate  the 
number  of  potential  fatalities  that  might  result  if  all  the  various  chemicals  at  a  facility 


Ibid.  p.  9. 

Elliott,  Michael  R.,  Paul  Kleindorfer,  and  Robert  A.  Lowe.  The  Role  of  Hazardousness 
and  Regulatory  Practice  in  the  Accidental  Release  of  Chemicals  at  US  Industrial  Facilities. 
Working  Paper  01-37-PK.  Risk  Management  and  Decision  Processes  Center,  The  Wharton 
School,  University  of  Pennsylvania.  Summer  2001.  22  p.  [http://opim.wharton.upenn.edu/ 
risk/downloads/0 1-37-PK.pdf],  visited  Sept.  20,  2004. 

Pianin,  Eric.  “Study  assesses  risk  of  attack  on  chemical  plant.”  Washington  Post,  Mar. 
12,2002.  p.  A8. 

Ibid. 

Army  recants  attack  estimates.  Chemical  Week,  May  22,  2002.  p  38. 


CRS-11 


were  released  suddenly. The  purpose  of  the  exercise  was  to  allow  DHS  to  prioritize 
chemical  facility  sites  for  inspections.  Assuming  that  released  chemicals  would 
move  in  the  direction  of  the  prevailing  winds,  DHS  determined  possible  fatalities 
within  a  wedge-shaped  zone.  It  identified  two  facilities  that  threaten  at  least  one 
million  people  downwind.  DHS  selected  360  facilities  for  its  attention  in  the  near 
term  based  on  these  estimates. 

Chemical  Site  Vulnerability.  CRS  identified  two  publicly  available  reports 
that  assess  site  security  at  U.S.  chemical  plants.  In  addition,  investigative  reports 
published  in  newspapers  or  documented  with  video  recordings  indicate  that  reporters 
have  been  able  to  visit  various  facilities  without  being  supervised.  The  studies  and 
selected  newspaper  accounts  are  summarized  below. 

Prior  to  September  11,  an  assessment  of  chemical  plant  site  security  by  the 
Agency  for  Toxic  Substances  and  Disease  Registry  (ATSDR)  was  considered  by 
many  to  be  the  most  comprehensive  analysis  that  was  publicly  available.  ATSDR 
researchers  reviewed  national  statistics  on  domestic  terrorism  compiled  by  the  FBI 
in  1995,  and  interviewed  security  staff  from  facilities  and  potential  targets  in  one 
community  with  numerous  chemical  plants ATSDR  researchers  concluded: 

•  “security  at  chemical  plants  ranged  from  fair  to  very  poor;”"^® 

•  chemical  plant  security  managers  “were  very  pessimistic  about  their 
ability  to  deter  sabotage  by  employees,  yet  none  of  them  had 
implemented  simple  background  checks  for  key  employees  such  as 
chemical  process  operators;”  and 

•  “none  of  the  corporate  security  staff  had  been  trained  to  identify 
combinations  of  common  chemicals  at  their  facilities  that  could  be 
used  as  improvised  explosives  and  incendiaries.”'^^ 

The  full  ATSDR  report  was  never  made  public,  but  a  DOJ  report  noted  that 

...  among  the  ‘soft  targets’  that  the  ATSDR  identified  as  potential  terrorist  sites 

were  chemical  manufacturing  plants  (chlorine,  peroxides,  other  industrial  gases, 


Block,  Robert.  Chemical  plants  still  have  few  terror  controls.  Wall  Street  Journal.  Aug. 
20,  2004,  p.  B.l. 

ATSDR.  Industrial  Chemicals  and  Terrorism:  Human  Health  Threat  Analysis,  Mitigation 
and  Prevention,  [http://www.techstuff.com/terror/terror.htm],  visited  Sept.  20,  2004. 

Greenpeace  activists  dramatized  the  poor  security  at  one  chlorine  manufacturing  plant  in 
February  2001.  According  to  a  report  in  the  Washington  Post,  activists  scaled  the  fence  of 
a  large  Dow  Chemical  plant  near  Baton  Rouge,  Louisiana,  and  gained  access  to  the  control 
panel  that  regulates  discharges  into  the  Mississippi  River.  (“Toxic  chemicals’  security 
worries  officials.”  Washington  Post,  Nov.  12,  2001,  p.  A14.) 

ATSDR  studied  two  communities  in  different  parts  of  the  United  States  but  only 
interviewed  plant  security  personnel  in  one  community. 
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plastics,  and  pesticides);  compressed  gases  in  tanks,  pipelines,  and  pumping 
stations;  and  pesticide  manufacturing  and  supply  distributors/* 

The  DOJ  released  a  study  April  18, 2000,  describing  the  risk  of  terrorism  aimed 
at  chemical  plants/^  It  concluded  that  “the  risk  of  terrorists  attempting  in  the 
foreseeable  future  to  cause  an  industrial  chemical  release  is  both  real  and  credible. 
The  study  also  noted  that  security  at  many  industrial  facilities  generally  is  “not  as 
substantial  as  the  security  at  other  comparable  potential  terrorist  targets.”^^ 

In  April  and  May,  2002,  six  to  seven  months  after  September  11,  2001,  the 
Pittsburgh  Tribune-Review  published  a  series  of  articles  describing  an  investigation 
of  plant  security  conducted  by  the  paper’ s  reporters.  On  April  7, 2002,  the  newspaper 
stated  that  “anyone  has  unfettered  access  to  more  than  two  dozen  potentially 
dangerous  plants  in  the  region”  (referring  to  western  Pennsylvania).^^  The  author  of 
the  report  continued; 

The  security  was  so  lax  at  30  sites  that  in  broad  daylight  a  Trib  reporter  — 
wearing  a  press  pass  and  carrying  a  camera  —  could  walk  or  drive  right  up  to 
tanks,  pipes  and  control  rooms  considered  key  targets  for  terrorists. 

The  report  was  based  on  reporters’  trips  to  30  plants  in  western  Pennsylvania  which 
have  filed  risk  management  plans  under  the  Clean  Air  Act,  Section  112.  Two  of  the 
plants  are  among  the  123  plants  nationwide  that  have  projected  potential  risks  to 
more  than  1,000,000  residents  in  the  event  of  a  worst-case  accident  or  attack.  The 
30  companies  constituted  more  than  half  of  the  61  sites  in  the  region  required  to  file 
risk  management  plans.  Fifteen  of  the  sites  to  which  reporters  gained  unchallenged 
access  were  water  treatment  facilities  in  Pennsylvania  and  Maryland. 

In  May,  another  Tribune-Review  article  described  a  similar  investigation  of  30 
additional  plants  in  Houston,  Baltimore,  and  Chicago. The  report  concluded  that 
security  was  lax  at  some  of  “the  potentially  deadliest  plants”  in  all  three  cities;  access 
was  easy  to  some  sites  owned  by  corporations  with  large  security  budgets; 
employees,  customers,  neighbors,  and  contractors  “not  only  let  a  stranger  walk 
through  warehouses,  factories,  tank  houses  and  rail  depots,  but  also  gave  directions 
to  the  most  sensitive  valves  and  control  rooms”;  and  access  to  19  sites  was  allowed 
due  to  “unguarded  rail  lines  and  drainage  ditches,  dilapidated  or  nonexistent  fences, 
open  doors,  poorly  angled  cameras  and  unmanned  train  gates.” 


Department  of  Justice,  p.  27. 

Ibid. 

“Ibid.,p.  2. 

Ibid.,  p.  30. 

Prine,  Carl.  Lax  security  exposes  letbal  chemical  supplies.  Pittsburgh  Tribune-Review, 
April  7,  2002,  at  [http://www.pittsburghlive.eom/x/tribunereview/specialreports/ 

potentialfordisaster/s_64612.html],  visited  Sept.  20,  2004. 

Prine,  Carl.  Chemicals  pose  risks  nationwide.  Pittsburgh  Tribune -Review,  May  5,  2002. 
[http://www.pittsburghlive.eom/x/tribune-review/specialreports/potentialfordisaster/s_69 
664.html],  visited  Sept.  20,  2004. 
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Chemical  manufacturers  and  users  contacted  by  reporters  said  that  they  had 
bolstered  security  recently.  Several  site  managers  reported  that  they  made  immediate 
changes  in  procedures  or  construction  plans  in  response  to  security  breaches  by  the 
reporters.  But  security  cannot  be  ensured  “overnight, ’’according  to  the  president  of 
the  Pennsylvania  Chemical  Industry  Council, and  it  can  be  expensive.  For  example, 
the  newspaper  reported  that  U.S.  Steel  spends  more  than  $1  million  each  year  to 
equip,  train,  and  hire  its  own  hazardous  chemicals  response  team,  firefighters, 
paramedics,  and  gate  guards  at  its  coke  factory. 

Television  crews  again  entered  and  photographed  chemical  storage  areas  in 
November  2003.^'’  Robert  Full,  Chief  of  the  Allegheny  County  Department  of 
Emergency  Services  in  Pennsylvania,  testified  February  23,  2004,  before  the 
Subcommittee  on  National  Security,  Emerging  Threats,  and  International  Relations, 
House  Committee  on  Government  Reform,  that  there  continued  to  be  facilities  in  his 
county  “that  one  could  walk  straight  in  under  the  guise  of  darkness  and  cause 
significant  damage  and  public  danger.”  He  stated,  “Some  of  the  facilities  have  no 
more  security  than  maybe  perhaps  a  padlock  or  a  chain.” 

In  mid- 2004,  surveys  were  distributed  to  189  U.S.  chemical  facilities  where 
workers  were  represented  by  the  Paper,  Allied-Industrial,  Chemical  and  Energy 
Workers  International  Union  (PACE).  Of  the  133  surveys  returned,  125  were  from 
facilities  where  workers  agreed  that  there  were  quantities  of  hazardous  materials  on 
site  large  enough  to  cause  a  catastrophic  event  if  they  were  released.  Responses  to 
the  survey  indicated  that  surveyed  workers  believed  nearly  three-quarters  of  the 
plants  had  improved  systems  to  guard  toxic  chemicals  and  had  conducted  drills  to 
respond  to  an  intrusion  by  terrorists. On  the  other  hand,  according  to  employees 
who  responded  to  questionnaires,  fewer  than  half  had  improved  communications, 
emergency  response  training,  warning  signals,  or  protective  equipment,  or  contacted 
local  first  responders  about  the  hazards  on  their  sites.  Nearly  two-thirds  of  the  plants 
had  not  discussed  terrorist  concerns  with  neighbors,  according  to  surveyed  workers.^* 


Prine,  April  7,  2002. 

Ibid. 

55  CBS  News.  “U.S.  Plants:  Open  to  Terrorists.”  Sixty  Minutes.  Nov.  17,  2003. 
[http://www.cbsnews.coin/stories/2003/l  l/13/60ininutes/main583528.shtml],  visited  Sept. 
20,  2004. 

5’  New  Perspectives  Consulting  Group,  Inc.,  PACE  Evaluation  Team.  October  2004.  PACE 
International  Union  Survey:  Workplace  Incident  Prevention  and  Response  Since  9/11 
Report. Durham,  NC.  pp.  48. 

5®  The  125  facilities  where  surveys  were  distributed  were  subject  to  risk  management 
planning  requirements  of  the  Clean  Air  Act,  Section  1 12(r),  based  on  public  databases  that 
were  available  and  current  in  2002.  Therefore,  the  survey  in  2004  may  have  included  a  few 
facilities  that  were  no  longer  covered  by  RMP  requirements.  Also,  the  PACE  report  notes 
in  the  Executive  Summary  on  page  iii,  “This  survey  looked  at  perceptions  only.  It  did  not 
include  an  independent  assessment  of,  for  example,  which  employees  actually  received 
training  since  September  11,  2001,  or  which  actions  companies  actually  took.” 
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Conclusion.  Whether  recent  trends  in  domestic  and  international  terrorism 
will  continue  into  the  future,  and  whether  they  will  be  reflected  in  risks  to  U.S. 
chemical  facilities,  is  unknown.  Historically,  there  have  been  very  few  terrorist 
attacks  on  chemical  facilities  in  the  United  States.  Therefore,  the  estimated  risk  of 
death  and  injury  from  such  attacks  in  the  immediate  future  is  low  relative  to  the 
likelihood  of  other  hazardous  events,  such  as  industrial  accidents  or  terrorist  attacks 
on  other  targets  using  conventional  weapons.  For  any  individual  chemical  plant,  the 
risk  of  attack  is  extremely  small.  However,  the  overall  risks  to  chemical  facilities 
may  be  increasing. 

In  contrast  to  the  low  probability  of  chemical  terrorism,  possible  consequences 
for  human  health  and  the  environment  from  such  an  event  could  be  severe. 
Moreover,  limited  evidence  suggests  that  chemical  facilities  may  be  “soft  targets,” 
lacking  in  adequate  safeguards  against  criminal  and  terrorist  attacks. 

Existing  Federai  Requirements  to  Reduce  Risks 
at  Chemicai  Faciiities 

Two  key  federal  laws  require  or  encourage  certain  chemical  facility  operators 
to  reduce  risks  to  the  general  public  associated  with  releases  of  hazardous  chemicals: 
the  Emergency  Response  and  Community  Right- to- Know  Act  (EPCRA)  and  the 
Clean  Air  Act  (CAA).  Both  focus  on  accidental  releases  of  hazardous  chemicals. 

EPCRA.  In  1986,  two  years  after  the  Bhopal  accident.  Congress  enacted 
EPCRA  (codified  at  42  U.S.C.  11001-11050)  as  Title  HI  of  the  Superfund 
Amendments  and  Reauthorization  Act  (P.E.  99-499).^^  EPCRA  mandated  the 
establishment  of  State  Emergency  Response  Commissions  (SERCs)  and  Eocal 
Emergency  Response  Committees  (EEPCs)  to  coordinate  planning  and  response  to 
potentially  large  releases  of  specified  “extremely  hazardous  substances.”'’'*  The  act 
requires  facility  operators,  EEPCs,  and  SERCs  to  prepare  contingency  plans  for  such 
releases. 

Eacility  managers  are  required  to  provide  information  to  EEPCs  and  local 
emergency  responders  (fire  fighters,  police  officers,  etc.)  about  chemicals  present  at 
facilities  and  to  notify  those  officials  in  the  event  of  a  sudden  release.  EPCRA 
requires  local  officials  to  provide  information  about  emergency  plans  and  chemical 
hazards  to  the  general  public. 


For  additional  information  about  EPCRA,  see  CRS  Report  RL30798,  Environmental 
Laws:  Summaries  of  Statutes  Administered  by  the  Environmental  Protection  Agency. 

“  EPCRA  required  EPA  to  list  “extremely  hazardous  substances”  and  to  establish  threshold 
planning  quantities  for  each  substance.  Originally,  Congress  defined  chemicals  as 
“extremely  hazardous  substances”  if  they  appeared  on  a  list  EPA  published  in  November 
1985  as  Appendix  A  in  “Chemical  Emergency  Preparedness  Program  Interim  Guidance.” 
However,  Congress  gave  EPA  authority  to  revise  the  list  and  the  threshold  quantities  of 
chemicals.  Based  on  listing  criteria,  the  intent  appears  to  be  to  include  only  chemicals  in 
quantities  that  could  harm  people  exposed  to  them  for  only  a  short  period  of  time. 
Currently,  there  are  approximately  356  such  substances  listed.  Eor  the  list,  see 
[http://www.epa.gov/swercepp/ehs/ehsalpha.html],  visited  Sept.  20,  2004. 


CRS-15 


EPCRA’ s  reporting  and  disclosure  requirements  are  meant  to  facilitate  planning, 
but  sometimes  they  also  promote  risk  reduction.  For  example,  facility  managers 
concerned  about  community  relations  sometimes  reduce  use  of  particularly  toxic  or 
otherwise  hazardous  materials,  sometimes  to  the  point  that  they  no  longer  have  to 
report,  because  they  no  longer  handle  reportable  quantities  of  EPCRA  chemicals.  In 
other  cases,  the  public  disclosure  requirement  may  encourage  them  to  change 
chemical  processes  and  handling  in  order  to  reduce  the  risk  of  reportable  spills. 

Although  EPCRA  requires  facility  reporting  and  cooperation  in  local  emergency 
response  planning,  and  it  may  encourage  risk  reduction,  it  stops  short  of  requiring 
facilities  to  assess  or  reduce  risks  of  chemical  releases.'’^  Instead,  the  act  directed  the 
EPA  to  study  the  problem  and  to  identify  any  gaps  in  federal  regulation. 

CAA  Section  112(r).  In  1990,  data  accumulated  by  EPA  on  chemical 
accidents  in  the  United  States  prompted  Congress  again  to  address  the  threat  of 
catastrophic  releases  of  chemicals  that  might  cause  immediate  deaths  or  injuries  in 
communities.  It  amended  the  Clean  Air  Act  (CAA)  to  mandate  EPA  oversight  of 
risk  management  planning  at  facilities  that  handle  more  than  specified  threshold 
quantities  of  hazardous  substances. The  act  defined  “hazardous  substances”  to 
include  chlorine,  anhydrous  ammonia,  methyl  chloride,  ethylene  oxide,  vinyl 
chloride,  methyl  isocyanate,  hydrogen  cyanide,  ammonia,  hydrogen  sulfide,  toluene 
diisocyanate,  phosgene,  bromine,  anhydrous  sulfur  dioxide,  sulfur  trioxide,  and  at 
least  100  other  chemicals  to  be  designated  by  EPA.  EPA  was  directed  to  designate 
chemicals  posing  the  greatest  risks  to  human  health  or  to  the  environment,  based  on 
three  criteria:  severity  of  potential  acute  adverse  health  effects,  the  likelihood  of 
accidental  releases,  and  the  potential  magnitude  of  human  exposure.  EPA 
promulgated  a  list  of  77  acutely  toxic  substances,  63  flammable  gases  and  volatile 
flammable  liquids,  and  “high  explosive  substances”  (59  Federal  Register  4478,  Jan. 
31, 1994).  The  list  was  amended  March  13, 2000,  to  exclude  flammable  substances 
when  used  as  a  fuel,  or  held  for  sale  as  a  fuel  at  a  retail  facility.®^  Selected  categories 
of  industries  with  large  numbers  of  reporting  facilities  are  identified  in  Table  1. 


Many  proponents  of  the  reporting  provisions  of  EPCRA  argue,  however,  that  public 
disclosure  of  information  about  chemicals  present  and  released  into  communities  sometimes 
prompts  facility  operators  to  reduce  risks. 

The  Clean  Air  Act  Amendments  of  1990  gave  responsibility  for  the  prevention  of 
accidental  chemical  releases  to  the  Occupational  Safety  and  Health  Administration  (OSHA) 
and  EPA.  OSHA  has  responsibility  for  the  protection  of  workers  from  accidental  chemical 
releases  and  has  promulgated  the  Process  Safety  Management  Standard  (29  CER  1910. 1 19) 
in  response  to  this  requirement.  EPA  has  incorporated  the  OSHA  Process  Safety 
Management  Standard  as  the  chemical  accident  prevention  program  for  certain  facilities 
subject  to  both  rules. 

65  Federal  Register  13243-13250. 
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Table  1.  Numbers  of  Facilities  Reporting  Risk  Management 
Plans  to  EPA  in  Selected  Industrial  Categories 


Number  of  reporting 
facilities 

(Total  =  16,010) 

Industrial  Categories  (NAICS  code)“ 

4,500 

Farm  supplies  wholesalers  (42291) 

2,048 

Water  supply  and  irrigation  (22131) 

1,439 

Wastewater  treatment  (22132) 

643 

Refrigerated  warehousing  and  storage  facilities  (49312) 

561 

Support  activities  for  crop  production  (11511) 

533 

Oil  and  gas  extraction  (21111) 

469 

Meat  processing  (31161) 

398 

Other  chemical  and  allied  production  wholesalers  (42269) 

372 

Basic  organic  chemical  manufacturing  (32519) 

368 

Basic  inorganic  chemical  manufacture  (32518) 

347 

Farm  production  warehousing  and  storage  (49313) 

309 

Electric  power  generation  (221 11) 

298 

Plastics  material  and  resin  manufacturing  (32521) 

290 

Fertilizer  manufacturing  (32531) 

232 

Liquified  petroleum  gas  dealers  (454312) 

169 

Petroleum  refineries  (32411) 

153 

All  other  chemical  product  manufacturing  (32599) 

139 

Industrial  gas  manufacturing  (32512) 

138 

Petroleum  hulk  stations  and  terminals  (42271) 

136 

General  warehousing  and  storage  facilities  (49311) 

103 

Petrochemical  manufacturing  (32511) 

2,365 

Other 

Source:  Congressional  Research  Service.  Numbers  were  obtained  by  searching  the  risk  management 
plans  for  U.S.  facilities  using  the  May  1,  2002  version  of  the  EPA  National  Database  (with  off-site 
consequence  data)  and  EPA’s  software  RMP*Review  (version  2.1). 

“  North  American  Industry  Classification  System  (NAICS)  codes. 
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The  CAA  Section  1 12(r)  imposes  “a  general  duty”  on  owners  and  operators  of 
facilities  producing,  processing,  handling  or  storing  any  “extremely  hazardous 
substance”  to  detect  and  prevent  or  minimize  accidental  releases  and  to  provide 
prompt  emergency  response  to  a  release  in  order  to  protect  human  health  and  the 
environment.  The  act  requires  owners  and  operators  of  covered  facilities  to  prepare 
Risk  Management  Plans  (RMPs)  that  summarize  the  potential  threat  of  sudden,  large 
releases  of  certain  chemicals,  including  the  results  of  off-site  consequence  analysis 
(OCA)  for  a  worst-case  chemical  accident,  and  facilities’  plans  to  prevent  releases 
and  mitigate  any  damage.  Plans  were  to  be  submitted  to  EPA  and  made  “available 
to  the  public”  by  June  21,  1999.  EPA  is  required  to  review  RMPs  regularly,  and  if 
necessary,  require  revisions.  EPA  has  delegated  this  responsibility  to  some  states  and 
localities. (All  states  have  authority  to  review  RMPs  at  facilities  that  are  major 
sources  of  air  pollution,  which  are  required  to  obtain  permits  under  Title  V  of  the 
Clean  Air  Act.)  Plans  must  be  revised  and  resubmitted  to  EPA  every  five  years. 
Eacilities  were  required  to  submit  updates  by  the  end  of  June  2004. 

In  October  1996,  the  Accident  Prevention  Subcommittee  of  the  Clean  Air  Act 
Advisory  Committee  to  EPA  created  the  Electronic  Submission  Workgroup  to 
consider  the  technical  and  practical  issues  associated  with  an  electronic  database  of 
risk  management  plans.  By  spring  1997,  the  Workgroup  unanimously  agreed  that 
EPA  should  provide  full,  unrestricted  access  via  the  Internet  to  most  RMP 
information.  However,  advisors  could  not  reach  consensus  regarding  access  to  OCA 
data. 


There  were  concerns  that  in  facilitating  electronic  access  to  the  general  U.S. 
public  through  the  Internet,  EPA  also  would  be  facilitating  access  to  these  data 
internationally,  which  might  permit  misuse  by  terrorists. Several  members  of  the 
Accident  Prevention  Subcommittee  recommended  EPA  undertake  a  security  study 
to  determine  how  much  risk  might  increase  as  a  result  of  putting  OCA  data  on  the 
Internet.  Aegis  Research  Corporation,  ICE  Incorporated,  and  Science  Applications 
International  Corporation  conducted  the  security  study  for  EPA.  The  Agency 
concluded  from  the  study  that  — 

...  the  risk  (although  still  very  small)  was  slightly  more  than  two  times  higher 
with  unrestricted  availability  of  the  RMP  with  OCA  data  on  the  Internet.  This 
increase  reflects  several  factors,  including  the  nature  of  the  OCA  data  elements 
and  the  enhanced  accessibility  of  data  on  the  Internet  to  an  international 
audience.  Taken  together,  the  primary  utility  of  the  unrestricted  RMP  and  OCA 


^  EPA  has  delegated  authority  to  implement  CAA  Section  112(r)  to  the  following  states, 
territories,  and  localities:  Delaware,  Florida,  Georgia,  Kentucky,  Mississippi,  New  Jersey, 
North  Carolina,  Ohio,  South  Carolina,  Puerto  Rico,  Virgin  Islands,  Jefferson  County, 
Kentucky,  Buncombe  County  and  the  City  of  Asheville,  North  Carolina,  Forsyth  County, 
North  Carolina,  and  Allegheny  County,  Pennsylvania.  Rhode  Island,  Nevada,  and  Hawaii 
are  seeking  delegated  authority.  See  [http://yosemite.epa.gov/oswer/ceppoweb.nsf/content/ 
1 12r-sts.htm#StateDelegation],  visited  Feb.  10,  2005. 

“  U.S.  EPA.  Security  Study:  An  Analysis  of  the  Terrorist  Risk  Associated  with  the  Public 
Availability  of  Offsite  Consequence  Analysis  Data  under  EPA ’s  Risk  Management  Pro  gram 
Regulations.  EPA  550-R97-003.  Dec.  1993.  p.  1. 
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data  to  a  terrorist  emerges  from  the  capability  to  scan  across  the  entire  country 

for  the  “best”  targets.®® 

In  December  1997,  EPA  began  discussions  with  the  FBI  and  other  federal 
agencies  about  the  electronic  RMP  distribution  plan.  National  security  concerns 
centered  on  the  OCA  data  and  their  potential  utility  to  terrorists.  An  interagency 
agreement  was  reached  in  late  October  1998  that  OCA  data  would  not  be  included 
in  RMP  information  placed  on  the  Internet.  Instead,  EPA  would  make  “appropriate” 
OCA  data  available  in  some  form  on  request,  but  access  would  be  restricted  and  not 
anonymous.®^  The  possibility  that  OCA  data  could  have  been  distributed  via  the 
Internet  remained,  however,  because  it  could  have  been  obtained  and  distributed  by 
any  citizen  under  the  Freedom  of  Information  Act,  according  to  the  EPA  Eegal 
Counsel. 

To  address  the  security  concerns  raised  by  the  Section  1 12(r)  requirements,  the 
Clinton  Administration  submitted  draft  legislation  to  Congress  May  7,  1999. 
Congress  enacted  an  amended  version  of  the  legislation  as  an  amendment  to  S.  880, 
the  Chemical  Safety  Information,  Site  Security  and  Fuels  Regulatory  Relief  Act  (P.E. 
106-40).  The  new  law  amended  Section  1 12  of  the  CAA  to  exempt  OCA  data  from 
disclosure  under  the  Freedom  of  Information  Act,  and  limited  public  availability  until 
EPA  and  DOJ  issued  regulations  in  August,  2000. 

The  final  RMP  regulation  on  data  access  was  published  August  4,  2000.®*  It 
allows  public  access  to  paper  copies  of  sensitive  OCA  information  through  federal 
reading  rooms,  approximately  one  per  state,  and  provides  Internet  access  to  the  OCA 
data  elements  that  pose  the  least  serious  criminal  risk.  State  and  local  agencies  are 
encouraged  to  provide  the  public  with  read-only  access  to  OCA  information  on  local 
facilities.  At  the  federal  reading  rooms,  members  of  the  public  may  read  OCA 
information  for  up  to  10  facilities  per  calendar  month  and  for  all  facilities  with 
potential  effects  in  the  jurisdiction  of  the  local  emergency  planning  committee.  State 
and  local  officials  and  other  members  of  the  public  may  share  OCA  information  as 
long  as  the  data  are  not  conveyed  in  the  format  of  sensitive  portions  of  the  RMP  or 
any  electronic  database  developed  by  EPA  from  those  sections. ®®  A  Clinton 
Administration  proposal  to  implement  the  final  rule  (66  Federal  Register  A021 ,  Jan. 
17,  2001)  would  have  allowed  people  to  view  plans  of  facilities  outside  their  local 
area  and  enhanced  access  for  “qualified  researchers .”  The  draft  plan  was  rescinded 
by  the  Bush  Administration  (66  Federal  Register  15254,  Mar.  16,  2001). 


®®  Ibid.  p.  10. 

®^  Blitzer,  Robert  M.,  Former  Section  Chief,  Domestic  Terrorism/Counterterrorism  Planning 
Section,  Federal  Bureau  of  Investigation.  Testimony  before  the  Senate  Committee  on 
Environment  and  Public  Works,  Subcommittee  on  Clean  Air,  Wetlands,  Private  Property 
and  Nuclear  Safety.  March  16,  1999. 

®*  65  Federal  Register  m01-m33. 

®®  EPA  Pact  Sheet.  “Chemical  Safety  Information,  Site  Security  and  Puels  Regulatory  Relief 
Act:  Public  Distribution  of  Off-Site  Consequence  Analysis  Information.”  EPA  550-P00-012, 
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The  1999  Act  also  directed  the  U.S.  General  Accounting  Office  (GAO,  now  the 
Government  Accountability  Office)  to  report  to  Congress  within  three  years  (i.e., 
before  August  2002)  on  “the  adequacy  of  chemical  information  required  to  be 
submitted  to  local  emergency  response  personnel  to  help  them  respond  to  chemical 
incidents,  the  adequacy  of  the  delivery  of  that  information,  and  the  level  of 
compliance  with  the  requirement  to  submit  the  information.”^®  That  report  was 
released  July  31,  2002.  GAO  concluded  that  EPA  officials  believe  industries 
generally  are  complying  with  reporting  requirements.  GAO’ s  conclusions  about  the 
adequacy  of  information  and  its  delivery  were  tentative  and  could  not  be  generalized 
to  the  universe  of  LEPCs. 

DOJ  also  was  directed  to  report  to  Congress  within  three  years  on  the  extent  to 
which  RMP  regulations  led  to  actions  “that  are  effective  in  detecting,  preventing,  and 
minimizing  the  consequences  of  releases  of  regulated  substances  that  may  be  caused 
by  criminal  activity,”  the  vulnerability  of  facilities  to  criminal  and  terrorist  activity, 
“current  industry  practices  regarding  site  security,”  and  security  of  transportation  of 
substances  listed  under  CAA  Section  112(r).”^'  The  law  directed  DOJ  to  consult 
with  state,  local  and  federal  agencies,  affected  industry,  and  the  public  in  preparing 
the  report,  and  to  submit  any  recommendations  to  Congress.  An  interim  report  was 
due  within  one  year  of  enactment  (i.e.,  by  August  2000).  DOJ  missed  the  interim 
report  deadline.  The  Natural  Resources  Defense  Council  (NRDC)  filed  a  lawsuit 
against  DOJ  March  11,  2002,  asserting  that  DOJ  unlawfully  withheld  or 
unreasonably  delayed  the  report’ s  submission  to  Congress. The  interim  report  was 
released  to  Congress  May  30,  2002,  but  withheld  from  the  public.  On  June  3,  2002, 
DOJ  filed  a  motion  to  dismiss  the  NRDC  lawsuit.  The  NRDC  moved  to  dismiss  its 
lawsuit  on  July  1,  2002. 

A  General  Accounting  Office  (GAO)  study  released  October  10,  2002, 
concluded  that  DOJ  failed  to  complete  the  mandated  study,  and  that  the  Department 
had  the  funds  to  do  so,  although  it  had  no  specific  appropriation.  “Generally,  when 
Congress  imposes  a  new  requirement  on  an  agency  but  does  not  appropriate  funds 
specifically  to  implement  it,  the  agency  must  use  existing  appropriations  to  fund  the 
requirement.”^^ 

After  September  1 1 ,  2001 

Administrative  Initiatives.  The  events  of  September  11, 2001,  bolstered  the 
view  that  access  to  information  about  facilities  should  be  restricted  if  it  might  make 


™  U.S.  GAO.  Chemical  Safety:  Emergency  Response  Community  Views  on  the  Adequacy 
of  Federally  Required  Chemical  Information.  GAO-02-799.  Washington,  DC:  U.S.  Govt. 
Print.  Off.  23  pp. 

42  use  7412(r)(7)(H)(xi). 

Natural  Resources  Defense  Council  v.  Ashcroft,  D.D.C.,  No.  02-0449,  Mar.  11,  2002. 

U.S.  General  Accounting  Office.  2002.  Homeland  Security:  Department  of  Justice’s 
Response  to  Its  Congressional  Mandate  to  Assess  and  Report  on  Chemical  Industry 
Vulnerabilities  (GAO-03-24R). 
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them  more  vulnerable  to  terrorist  attacks.  This  led  EPA  to  limit  Internet  access  on 
its  website  to  “sensitive”  data. 

Early  in  October  200 1 ,  EPA  removed  from  its  website  general  information  from 
risk  management  plans  —  for  example,  about  the  physical  state  and  concentrations 
of  chemicals  at  facilities  and  the  duration  of  a  possible  chemical  release  —  which 
previously  had  been  considered  acceptable  for  Internet  posting.  EPA  reportedly 
found  no  other  information  that  should  be  removed  from  the  Internet  during  the  next 
few  months,  but  officials  remained  concerned  about  posted  information  on  facility 
locations  that  might  be  of  use  to  criminals  and  terrorists. On  March  14,  2002,  EPA 
restricted  access  to  Envirofacts,  a  link  to  several  EPA  databases  that  allowed  the  user 
to  access  facility-specific  information  about  chemical  releases,  compliance  with 
environmental  laws,  and  other  issues.  The  next  week,  the  White  House  sent  a 
memorandum  to  all  federal  agencies,  ordering  them  to  further  review  and  protect 
information  that  might  be  used  to  threaten  national  security  or  public  safety.  On  May 
6,  2002,  President  Bush  signed  an  administrative  order  granting  the  EPA 
Administrator  the  authority  to  classify  as  “secret”  information  that  might  pose  a 
national  security  risk.^^ 

On  the  other  hand,  the  attacks  of  September  1 1  led  to  increased  communication 
among  government  officials  at  all  levels,  as  well  as  facility  owners  and  operators. 
Eor  example,  EPA  advised  pesticide  companies  and  applicators  to  be  especially 
vigilant  about  physical  security  of  chemicals  and  equipment.  The  Agency  issued  a 
“chemical  safety  alert”  tailored  to  the  security  needs  of  the  pesticide  industry,  based 
on  an  earlier  paper  on  site  security  of  chemical  plants  that  first  was  issued  in  Eebruary 
2000.^'’  In  September  2002,  EPA  also  sent  about  9,400  drinking  water  utilities  advice 
about  securing  facilities  from  terrorists.  (About  2,000  drinking  water  utilities  submit 
risk  management  plans  that  include  worst-case  scenarios  under  the  CAA  Section 
112(r).) 

In  Eebruary  2003,  the  White  House  released  The  National  Strategy  for  the 
Physical  Protection  of  Critical  Infrastructures  and  Key  Assets.  It  outlines  goals, 
principles,  “a  unifying  structure,”  roles  and  responsibilities,  and  the  major  cross¬ 
sector  and  sector-specific  initiatives  of  national  efforts  to  secure  infrastructures  and 
“assets  vital  to  our  public  health  and  safety,  national  security,  governance,  economy, 
and  public  confidence.”’’  Chemical  facilities  are  addressed  in  connection  with  three 
critical  infrastructure  sectors:  the  chemical  industry  and  hazardous  materials,  water, 
and  energy.  EPA  was  the  designated  lead  federal  agency  for  the  chemical  industry 


Preston,  Meredith.  “Agency  considers  new  ways  to  make  data  on  Internet  site  available 
to  public,”  Daily  Environment  Report,  Feb.  22,  2002,  p.  A-14. 

67  Federal  Register  31109,  May  9,  2002. 

The  alerts  are  available  through  the  EPA  website  at 
[http://yosemite.epa.gov/oswer/ceppoweb.nsf/content/ap-chsa.htm],  visited  Sept.  20, 2004. 

Bush,  George  W.  Cover  letter  to  The  National  Strategy  for  the  Physical  Protection  of 
Critical  Infrastructures  and  Key  Assets.  Feb.  2003.  83  pp. 
[http://www.whitehouse.gov/pcipb/physical.html],  visited  Sept.  20,  2004. 
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and  water,  while  the  Department  of  Energy  (DOE)  was  the  designated  lead  agency 
for  energy. 

With  respect  to  the  chemical  industry  and  hazardous  materials,  the  Strategy 
acknowledged  both  the  potential  economic  consequences  of  a  successful  attack  on 
the  sector  and  the  potential  threat  to  public  health  and  safety.  It  aimed  to  assure 
supply  to  downstream  users  of  chemical  products,  to  protect  and  assure  the  quality 
of  chemical  stockpiles,  and  to  reduce  the  risk  of  malicious  use  of  inherently 
hazardous  chemicals.  The  Strategy  noted  that  “there  is  currently  no  clear, 
unambiguous  legal  or  regulatory  authority  at  the  federal  level  to  help  ensure 
comprehensive,  uniform  security  standards  for  chemical  facilities.”^*  In  particular, 
the  Strategy  observed  that  federal  laws  might  be  out-of-date  and  no  longer  effective 
for  monitoring  and  controlling  access  to  dangerous  substances.  The  President 
proposed  that  DHS,  in  concert  with  EPA,  should  “work  with  Congress  to  enact 
legislation  to  require  certain  chemical  facilities,  particularly  those  that  maintain  large 
quantities  of  hazardous  chemicals  in  close  proximity  to  population  centers,  to 
undertake  vulnerability  assessments  and  take  reasonable  steps  to  reduce  the 
vulnerabilities  identified.”’^  The  Strategy  also  proposed  that  EPA,  in  concert  with 
DHS,  should  review  current  laws  and  regulations  pertaining  to  “the  distribution  and 
sale  of  highly  toxic  pesticides  and  industrial  chemicals.”  Einally,  the  Strategy 
suggested  that  DHS  and  EPA  should  encourage  participation  in  the  chemical  sector’ s 
Information  Sharing  Analysis  Center.  The  fact  that  security  can  be  expensive  also 
was  noted. 

The  Strategy  described  the  importance  of  water  from  a  public  health  and  an 
economic  standpoint  and  noted  that  security  of  the  water  sector  against  terrorism  had 
been  greatly  enhanced  since  September  1 1 , 200 1 .  Challenges  facing  the  water  sector, 
according  to  the  Strategy,  included  the  need  to  protect  against  intentional  release  of 
toxic  chemicals  so  as  to  protect  the  safety  of  people  who  reside  or  work  near  water 
facilities.  The  Strategy  proposed  that  EPA  and  DHS  identify  better  ways  to  secure 
key  points  of  storage  and  distribution;  improve  monitoring  and  analysis,  information 
exchange,  and  contingency  planning;  and  manage  risks  due  to  interdependencies  with 
other  critical  infrastructures. 

The  energy  sector  was  divided  into  two  sections:  electricity  and  the  oil/natural 
gas  industries.  Overall,  energy  was  described  as  “essential  to  our  economy,  national 
defense,  and  quality  of  life.”*°  The  Strategy  proposed  that  DHS  and  DOE  work  with 
state  and  local  governments  and  industry  to  identify  “appropriate  levels  of 
redundancy”  and  requirements  for  “designing  and  enhancing  reliability.”  In  addition, 
DHS  and  DOE  were  to  work  with  oil  and  natural  gas  industry  representatives  to 
“define  consistent  criteria  for  criticality,  standard  approaches  for  vulnerability  and 
risk  assessments,”  and  “physical  security  training  for  industry  personnel.”*'  An 
advisory  task  force  was  to  be  convened  by  DHS  and  DOE  to  identify  appropriate 


™  Ibid.,  p.  65. 

Ibid.,  p.  66. 
*°Ibid.,p.  50. 
*'  Ibid. 
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planning  requirements  and  approaches.  Finally,  the  Strategy  proposed  that  DHS  and 
DOE  work  with  industry  “to  develop  regional  and  national  programs  for  identifying 
spare  parts,  requirements,  notifying  parties  of  their  availability,  and  distributing  them 
in  an  emergency.”  There  is  no  mention  in  this  section  of  the  hazardous  chemicals 
present  in  some  facilities  in  the  energy  sector.^^  However,  it  may  be  the 
Administration’s  intention  that  certain  facilities,  such  as  oil  refineries,  electric/gas 
utilities,  and  bulk  storage  facilities,  would  be  included  in,  and  targeted  by  initiatives 
in,  multiple  critical  infrastructure  sectors. 

As  the  war  began  in  Iraq,  the  President  launched  Operation  Liberty  Shield,  a 
surveillance  program  to  provide  additional  security  for  potentially  threatened 
facilities  in  the  critical  infrastructure.  Chemical  plants  were  among  the  potential 
focal  points  of  the  initiative. 

On  December  17,  2003,  the  President  issued  Homeland  Security  Presidential 
Directive  7  transferring  to  DHS  all  EPA  authority  for  overseeing  the  security  of 
chemical  facilities,  with  the  single  exception  of  drinking  water  and  water  treatment 
plants .  In  addition,  the  directive  revised  the  Administration’ s  strategy  for  protecting 
critical  infrastructure  by  designating  DHS  the  lead  agency  for  the  chemical  sector. 
The  directive  requires  that  DHS  “identify,  prioritize,  and  coordinate  the  protection 
of  critical  infrastructure  and  key  resources  with  an  emphasis  on  critical  infrastructure 
and  key  resources  that  could  be  exploited  to  cause  catastrophic  health  effects  or  mass 
casualties  comparable  to  those  from  the  use  of  a  weapon  of  mass  destruction”  (HSPD 
7,  paragraph  12).  In  addition,  DHS  must  conduct  or  facilitate  vulnerability 
assessments  of  the  chemical  sector  and  “encourage  risk  management  strategies  to 
protect  against  and  mitigate  the  effects  of  attacks.”  Einally,  all  departments  and 
agencies  are  directed  “to  work  with  sectors  relevant  to  their  responsibilities  to  reduce 
the  consequences  of  catastrophic  failures  not  caused  by  terrorism”  and  to  cooperate 
with  the  DHS  Secretary. 

Private  Sector  Initiatives.  Although  trade  associations  for  the  chemical 
industries  have  been  engaged  in  emergency  planning  for  many  years,  and  began 
developing  guidelines  for  site  security  at  least  a  year  before  September  1 1 , 200 1 ,  the 
events  of  that  date  infused  on-going  efforts  with  commitment  and  energy  that 
previously  were  not  evident. 

The  American  Chemistry  Council  (ACC,  formerly  the  Chemical  Manufacturers 
Association),  the  Chlorine  Institute,  Inc.,  and  the  Synthetic  Organic  Chemical 
Manufacturers  Association  issued  Site  Security  Guidelines  for  the  U.S.  Chemical 
Industry  on  October  23,  2001.  The  guidelines  build  on  “Management  Practice  15: 
Site  Security”  in  the  Responsible  Care®  Employee  Health  and  Safety  Code. 
Responsible  Care®  is  the  ACC’s  response  to  general  public  concerns  about  the 
manufacture  and  use  of  chemicals.  Members  of  the  ACC  are  required  to  commit  to 
the  principles  of  Responsible  Care®  and  “to  support  a  continuing  effort  to  improve 
the  industry’ s  responsible  management  of  chemicals”  by  continually  improving  their 
health,  safety  and  environmental  performance;  listening  and  responding  to  public 


However,  the  first  of  the  8  guiding  principles  underpinning  the  strategy  is  “assure  public 
safety,  public  confidence,  and  services.” 
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concerns;  assisting  other  companies  to  achieve  optimum  performance;  and  reporting 
their  goals  and  progress  to  the  public.”*^  There  were  180  corporate  ACC  members 
that  operated  approximately  1,000  chemical  facilities  in  2002,  representing  about 
90%  of  U.S.  chemical  production  capacity.*"^  The  ACC  guidelines  for  site  security 
are  general,  and  must  be  adapted  by  chemical  companies  to  meet  site  requirements. 

During  April  2002,  ACC  circulated  a  draft  of  a  Security  Code  of  Management 
Practices  — 

...  to  help  companies  achieve  continuous  improvement  in  security  performance 

using  a  risk-based  approach  to  identify,  assess  and  address  vulnerabilities, 

prevent  or  mitigate  incidents,  enhance  training  and  response  capabilities,  and 

maintain  and  improve  relationships  with  key  stakeholders.®^ 

On  June  5,  2002,  the  ACC  Board  of  Directors  approved  the  code  and  voted  to  make 
it  mandatory  for  ACC  members.  Some  key  requirements  of  the  code  include: 

•  training  and  drills  for  employees,  contractors,  customers,  and 
suppliers; 

•  consideration  of  process  changes,  material  substitutions,  and  other 
inherently  safer  approaches  to  chemical  production; 

•  evaluation,  response,  and  reporting  of  security  threats;  and 

•  internal  audits.*^ 

ACC  members  are  required  to  evaluate  site  security  using  vulnerability  assessment 
methodology  equivalent  to  that  developed  by  the  Department  of  Energy’s  Sandia 
Laboratories  for  the  Department  of  Justice*^  or  by  the  Center  for  Chemical  Process 
Safety  (an  industry-funded  research  center). 

ACC  members  began  by  assessing  security,  including  computer  security,  at 
high-risk  facilities,  as  well  as  from  supplier  to  manufacturer,  to  wholesaler,  to 
retailer,  and  finally  to  customer.  On  March  7,  2003,  ACC  announced  that  all  165  of 
its  member  companies  had  completed  site  vulnerability  assessments  for  their  120 
highest  priority  facilities,  prior  to  the  end  of  2002,  a  deadline  established  by  the 


The  principles  of  Responsible  Care®  are  listed  on  the  ACC  website  at 
[http://www.americanchemistry.coin/],  visited  Sept.  20,  2004. 

Heilprin,  John.  “Government  to  require  15,000  chemical,  waste,  water  plants  to  assess 
terrorism  risks,  make  fixes,”  The  Associated  Press,  via  NewsEdge  Insight,  June  7,  2002. 

ACC.  Responsible  Care®  Security  Code  of  Management  Practices  Draft  Concepts,  April 
18,  2002. 
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industry’s  security  code.^*  (ACC  lost  some  members  prior  to  the  deadline,  in  part  due 
to  difficult  economic  conditions  for  the  industry.  By  early  2005,  membership  was 
down  to  140  companies.)*®  After  needed  security  measures  have  been  put  into  place 
for  these  high-priority  facilities  (site  enhancements  were  to  be  completed  before  the 
end  of  2003),  the  ACC  code  requires  verification  by  an  independent  third  party  (also 
before  the  end  of  2003).  Additional  facilities  will  undergo  assessment  and  security 
enhancements  in  2004.  However,  the  security  code  does  not  require  expenditures  for 
risk  reduction;  rather,  it  recommends  decisions  should  be  based  on  an  evaluation  of 
risks  and  costs.  However,  according  to  ACC,  facilities  spent  more  than  $800  million 
to  improve  security  in  2003  alone. 

In  addition  to  developing  guidelines  and  a  management  code  on  site  security, 
ACC  and  other  chemical  trade  organizations  have  been  communicating  extensively 
with  one  another  and  with  government  officials  about  how  to  reduce  the  risks  of 
chemical  terrorism.  For  example,  ACC  and  the  Association  of  American  Railroads 
formed  a  task  force  to  develop  strategies  to  ensure  the  safety  of  communities  near 
chemical  and  rail  facilities.®'  In  addition,  as  mentioned  above,  the  Center  for 
Chemical  Process  Safety  has  developed  a  risk-based  methodology  for  assessing  the 
vulnerability  of  chemical  facilities  to  terrorist  attacks.  The  Synthetic  Organic 
Chemical  Manufacturers  Association  (SOCMA)  has  developed  a  vulnerability 
assessment  methodology  for  smaller  chemical  producers.®^  In  addition,  SOCMA  has 
adopted  the  ACC  security  code  as  a  condition  of  membership.  According  to  Tom 
Hall,  director  of  stewardship  for  CropLife  America  (a  pesticide  industry  trade 
association),  pesticide  and  fertilizer  distributors  represented  by  CropLife  America, 
the  Fertilizer  Institute,  and  the  Agricultural  Retailers  Association  formed  a  working 
group  to  tailor  a  vulnerability  asses sment  methodology  for  rural  facilities ,  where  theft 
is  a  greater  threat  than  a  direct  attack  on  a  facility.®*  A  document.  Guidelines  to  Help 
Ensure  a  Secure  Agribusiness,  was  released  October  24,  2002.®"'  Finally,  the 
American  Petroleum  Institute  has  published  security  guidelines  developed  in 
consultation  with  the  Department  of  Energy. 

The  U.S.  General  Accounting  Office  examined  the  voluntary  initiatives 
underway  in  a  report  released  in  March  2003,  Homeland  Security:  Voluntary 


**  ACC.  “Chemical  makers  complete  priority  site  vulnerability  assessments,  continue 
security  performance  through  Responsible  Care®”  Press  release,  Mar.  7,  2003,  [http:// 
www.accnewsmedia.com/docs/1 100/1090.doc?DocTypeID=4&TrackID=],  visited  Sept.  20, 
2004. 
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Initiatives  Are  Under  Way  at  Chemical  Facilities  but  the  Extent  of  Security 
Preparedness  Is  Unknown.^^  GAO  concluded  that  many  initiatives  are  admirable,  but 
“the  extent  of  security  preparedness  at  U.S.  chemical  facilities  is  unknown  ... 
[because]  no  federal  requirements  are  in  place  to  require  chemical  facilities  to  assess 
their  vulnerabilities  and  take  steps  to  reduce  them  ...  and]  no  federal  oversight  or 
third-party  verification  ensures  that  voluntary  industry  assessments  are  adequate  and 
that  necessary  corrective  actions  are  taken.” 

Policy  Options 

September  11,  2001  prompted  policy  makers  to  reconsider  federal  policy 
options  regarding  potential  terrorist  threats  to  chemical  facilities.  A  range  of  possible 
strategies  is  summarized  below. 

Status  Quo.  Congress  might  rely  on  existing  mechanisms  in  the  public  and 
private  sectors  to  continuously  evaluate  and  improve  site  security.  Federal  statutes 
already  mandate  facility  assessments  of  chemical  hazards  and  planning  to  prevent, 
mitigate,  and  respond  to  accidental  releases  of  hazardous  chemicals.  And  the  events 
of  September  11,  2001,  undoubtedly  have  reinvigorated  implementation  efforts  by 
federal,  state,  and  local  government  officials,  as  well  as  facility  operators.  Some  state 
and  local  governments  have  instituted  additional  security  requirements .  For  example, 
Baltimore,  Maryland,  requires  chemical  facilities  to  implement  security  measures 
described  by  police  and  fire  officials.  Moreover,  trade  associations  have  developed 
vulnerability  assessment  methodologies  to  facilitate  planning  for  diverse  types  of 
facilities.  The  ACC  requires  that  its  members  assess  vulnerability  and  devise  plans 
to  improve  security. 

The  establishment  of  a  Department  of  Homeland  Security  (DHS)  and  Homeland 
Security  Presidential  Directive  7  on  the  protection  of  critical  infrastructure  ensure  a 
federal  role  in  chemical  facility  security  planning.  The  President  directed  DHS  to 
identify  and  prioritize  facilities  needing  protection  from  terrorists,  to  facilitate 
vulnerability  assessment  and  security  planning,  and  to  coordinate  private,  local,  state, 
and  federal  initiatives  to  improve  security.  However,  many  in  Congress  and 
President  Bush  have  stated  that  the  federal  government  might  need  additional 
authority  to  require  security  measures  at  chemical  facilities,  and  called  for  legislation 
that  would  provide  that  authority.^® 

Collect  Additional  Information.  Another  option  would  be  to  delay 
addressing  chemical  facility  security  until  additional  information  is  gathered  on 
which  to  base  proposals.  The  final  DOJ  assessment  of  chemical  site  security  and  the 
impact  of  the  current  risk  management  planning  program  might  provide  needed 
insights.  For  a  broader  view  of  the  issue,  including  analysis  of  policy  options. 


U.S.  GAO.  Homeland  Security:  Voluntary  Initiatives  Are  Under  Way  at  Chemical 
Facilities  but  the  Extent  of  Security  Preparedness  is  Unknown.  GAO-03-439GAO-03-439. 
March  2003,  41  pp.  [http://www.gao.gov/new.items/d03439.pdf],  visited  Sept.  20,  2004. 
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Congress  might  establish  a  Blue  Ribbon  Panel  or  request  a  study  by  the  National 
Academy  of  Sciences.  Studies  could  provide  information  about  the  risks  of 
terrorism,  the  risks  of  accidents,  the  views  of  public  interest  groups,  and  the 
effectiveness  of  public  disclosure  to  reduce  risks.  Such  information  might  assist 
Congress  in  evaluating  alternative  approaches  to  reducing  risks.  However,  the 
benefits  gained  from  delaying  federal  decisions  pending  development  of  better  risk 
information  must  be  weighed  against  the  possibility  that  terrorists  might  strike  this 
kind  of  facility  before  Congress  acts. 

Improve  EPA  Guidance  and  Enforcement.  Congress  also  might  provide 
additional  resources  for,  or  exercise  increased  oversight  over,  implementation  of 
existing  statutes.  Although  neither  EPCRA  nor  the  CAA  explicitly  addresses 
chemical  releases  due  to  criminal  or  terrorist  acts,  EPA  arguably  has  sufficient 
authority  under  the  acts  to  more  strongly  encourage  facilities  to  reduce  their 
vulnerability  to  terrorists.  Additional  resources  could  facilitate  EPA  review  of 
facility  risk  management  plans.  Through  September  2001,  EPA  had  reviewed  only 
15%  of  submitted  plans,  according  to  a  recent  report  by  the  U.S.  General  Accounting 
Office  (GAO).'*' 

As  previously  mentioned,  EPA  already  has  provided  guidance  to  facilities  on 
this  subject,  but  many  public  interest  groups  would  like  EPA  to  go  farther  in 
interpreting  the  risk  management  planning  requirements  of  the  CAA  Section  1 12(r).^* 
Eor  example,  US  PIRG  argued  in  a  1998  report: 

EPA  missed  opportunities  to  require  companies  to  identify  inherently  safer 
technologies,  and  ignored  comments  made  by  a  coalition  of  environmental  and 
labor  organizations  calling  for  a  requirement  that  companies  undertake 
Technology  Options  analyses  to  identify  inherently  safer  technologies.^^ 

In  lieu  of  regulations,  EPA  could  be  urged  to  provide  technical  assistance  or 
demonstration  programs,  or  to  develop  incentives  to  encourage  risk  reduction. 

EPA  has  considered  revisions  to  either  the  risk  management  planning  rule  or 
EPA  guidance  under  the  CAA  Section  112(r)(7)  to  require  or  encourage  chemical 
facility  owners  to  assess  their  vulnerability  to  terrorists  and  correct  any  significant 
weaknesses.  Some  EPA  officials  expected  new  principles  for  risk  management 
planning  to  address  both  site  and  computer  security;  building  access;  background 
checks;  inventory  controls;  storage  safety;  and  other  physical  security  measures,  as 
well  as  changes  that  improve  “inherent  safety.”'°° 
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However,  EPA  has  stated  that  its  authority  to  regulate  chemical  site  security  is 
unclear,  and  authority  under  the  Clean  Air  Act  has  been  questioned  by  the  House 
Committee  on  Energy  and  Commerce.'”'  In  October  2002,  Administrator  Whitman 
announced  that  EPA  would  not  pursue  chemical  security  regulations  under  the 
CAA.'”^  President  Bush  has  made  it  clear  that  he  does  not  envision  a  large  role  for 
EPA  with  respect  to  security  from  terrorism.  Congress  might  ultimately  elect  to 
clarify  EPA  authority  through  legislation,  expanding  or  narrowing  current 
interpretations,  or  examine  the  adequacy  of  EPA’s  implementation  of  the  risk 
management  planning  rule  in  congressional  hearings. 

A  potential  disadvantage  of  relying  on  existing  law  is  that  it  may  not  apply  to 
all  facilities  of  interest.  Eor  example,  the  CAA,  Section  112  applies  to  chemicals  that 
were  selected  based  on  severity  of  potential  acute  adverse  health  effects,  the 
likelihood  of  accidental  releases,  and  the  potential  magnitude  of  human  exposure. 
It  excludes  flammable  substances  when  used  as  a  fuel,  or  held  for  sale  as  a  fuel  at  a 
retail  facility. 

Reduce  Risk  Through  Legislation.  GAO  has  recommended  that  DHS  and 
EPA,  in  consultation  with  the  Office  of  Homeland  Security,  jointly  develop  a 
comprehensive  national  chemical  security  strategy,  which  should  include  a  legislative 
proposal  “to  require  chemical  facilities  to  expeditiously  assess  their  vulnerability  to 
terrorist  attacks  and,  where  necessary,  require  these  facilities  to  take  corrective 
action.”"*^  DHS  and  EPA  agree.'”"'  The  National  Strategy  for  the  Physical 
Protection  of  Critical  Infrastructures  and  Key  Assets  asks  DHS  to  work  with 
Congress  to  enact  such  legislation. 

If  Congress  decides  that  legislation  is  required  to  reduce  the  risks  of  terrorism 
targeting  chemical  plants,  proposals  might  focus  on  preventing  terrorism  in  general 
or  on  reducing  risks  of  terrorism  specifically  targeting'”^  chemical  plants.  A  broad 
focus  on  reducing  terrorism  would  involve  numerous  issues  that  are  beyond  the  scope 
of  this  report.  Interested  readers  are  referred  to  CRS  Issue  Brief  IBI0II9,  Terrorism 
and  National  Security:  Issues  and  Trends. 

A  narrower  focus  on  chemical  plants  might  provide  incentives  for  voluntary 
private  sector  initiatives  or  new  regulatory  authorities  to  reduce  risks.  Economists 
Robert  Eitan  and  Peter  Orszag  have  suggested  that  a  blended  approach  involving 
performance-based  regulation  and  a  requirement  for  insurance  coverage  against 
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terrorist  acts  might  be  the  most  cost-effective  approach/”*’  Stakeholder  views 
regarding  the  relative  merits  of  voluntary  versus  mandatory  approaches  are  discussed 
in  the  next  major  section  of  this  report,  Policy  Issues,  in  the  subsection  on 
Responsibility  and  Accountability.  Bills  under  current  consideration  are  described 
in  the  last  major  section  of  this  report.  Legislation  in  the  109*  Congress. 

The  remainder  of  the  present  discussion  analyzes  selected  strategies  and  tactics 
for  reducing  risks  that  may  be  incorporated  into  legislation. 

Physical  Security  Enhancement.  Perhaps  the  most  common  approach  to 
improving  site  security  is  to  “harden”  defenses  so  that  sites  would  be  less  vulnerable 
to  terrorists. According  to  the  recently  released  DOJ  vulnerability  assessment 
methodology,  an  effective  protection  system  serves  three  functions:  detection 
(discovery  or  sensing  of  adversary  action),  delay  (impediment  to  adversary  progress), 
and  response  by  security  personnel  to  ensure  that  a  threat  is  neutralized.'”*  Examples 
of  hardening  tactics  include  increasing  security  patrols,  strengthening  fences, 
installing  better  locks  on  doors,  relocating  sensitive  chemical  processes  within  the 
facility,  installing  intruder  detection  systems  and  alarms,  and  performing  background 
checks  on  employees.  Congress  has  adopted  such  tactics  in  other  contexts.  For 
example,  the  USA  Patriot  Act  (P.L.  107-56)  requires  background  checks  as  a 
condition  for  obtaining  a  license  to  operate  a  motor  vehicle  transporting  in  commerce 
a  hazardous  material. 

A  key  advantage  of  hardening  tactics  is  their  variety  and  adaptability  to  a  range 
of  security  needs.  Other  advantages  include  the  ability  to  deepen  defenses  by  adding 
layers  of  protection  and,  in  many  cases,  relatively  low  costs.  A  potential  weakness 
of  this  strategy  is  that  even  the  most  effective  security  measures  might  be  disabled 
or  overwhelmed  by  a  determined,  skilled  terrorist  organization.  For  example,  guards 
may  be  bribed  or  killed,  passwords  discovered,  alarms  short-circuited,  or  computers 
hacked.  The  World  Trade  Center  and  Pentagon  attacks  demonstrate  the  vulnerability 
of  any  site  to  a  novel  and  vigorous  attack 

Technology  Assessment  and  inherently  Safer  Options.  An  alternative 
strategy  for  reducing  risk  is  advocated  by  environmental  groups.  It  would  reduce  the 
hazardous  characteristics  of  the  facility,  for  example,  by  reducing  production, 
processing,  storage,  and  use  of  dangerous  chemicals,  or  changing  the  characteristics 
of  chemicals  to  make  them  less  dangerous  (e.g.,  by  reducing  volatility).  Such  tactics 
aim  to  improve  the  “inherent  safety”  of  a  site,  and  are  preferred  by  advocates  to 
target-hardening  tactics,  which  they  often  refer  to  as  “add-on  safety  systems.”'”” 
According  to  this  view,  “‘Inherent  Safety’  activities  reduce  or  eliminate  the 
possibility  of  an  accident  occurring  through  the  fundamental  redesign  of  production 
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systems  or  products,  reductions  in  chemical  inventories,  or  substitution  for  hazardous 
chemicals  at  the  facility.”“°  Currently,  there  is  no  U.S.  law  that  explicitly  promotes 
use  of  safer  technologies  by  the  chemical  industry. 

Two  potential  advantages  of  this  approach  are  that  consequences  of  terrorism 
may  be  reduced  even  if  a  terrorist  succeeds  in  his  mission,  and  that  risks  associated 
with  accidental  releases  of  chemicals  also  are  likely  to  be  reduced.  In  addition, 
efforts  to  promote  inherent  safety  of  production  could  fill  gaps  in  current  laws,  which 
address  risks  associated  with  specified  chemicals  and  industries.  According  to  the 
U.S.  Chemical  Safety  and  Hazard  Investigation  Board,  many  reactive  chemicals 
responsible  for  industrial  accidents  are  not  covered  by  the  CAA  Section  112.'" 

Many  facility  operators  have  applied  this  approach  in  recent  years.  For  example, 
a  utility  in  Ohio  chose  to  employ  a  urea-based  pollution  control  system  instead  of 
another  system  which  would  have  required  storage  of  large  quantities  of  ammonia."^ 
Shortly  after  September  11,  the  Blue  Plains  wastewater  treatment  facility  in 
Washington  D.C.  stopped  using  chlorine  in  favor  of  the  less  volatile  sodium 
hypochlorite  bleach."^  Other  water  and  wastewater  treatment  plants  are  making 
similar  changes  in  chemical  usage. 

The  key  disadvantages  of  this  “safer”  facility  strategy  are  potentially  higher 
production  and  research  and  development  costs,  delays  in  achieving  security  while 
new  processes  are  put  into  place,  and,  at  least  in  some  cases,  lack  of  feasibility. 
However,  advocates  argue  that  use  of  safer  technologies  may  reduce  production  costs 
by  reducing  regulatory  burdens,  insurance  premiums,  transportation  costs,  and  waste 
disposal  costs.  Another  potential  disadvantage  of  the  strategy  is  that  some  “safer” 
tactics  may  simply  spread  a  risk  around,  shift  the  risk  to  other  locations  or 
populations,  or  substitute  one  risk  for  another.  For  example,  in  replacing  an  acutely 
toxic  chemical  (that  produces  relatively  severe  health  effects  after  a  short  exposure) 
with  a  less  acutely  toxic  chemical,  one  might  increase  chronic  risks  (due  to  low-level, 
long-term  exposures)  or  environmental  risks  (e.g.,  due  to  the  chemical’ s  persistence). 

Deterrence.  A  third  approach  to  reducing  risks  aims  to  reduce  theft,  rather 
than  direct  attacks,  by  making  dangerous  chemicals  in  use  at  a  facility  less  attractive 
to  criminals,  for  example,  by  introducing  a  color  or  other  property  that  facilitates 
detection  and  tracking  by  authorities  (so-called  “taggants”),  or  by  creating  and  storing 
antidotes  to  toxic  effects.  A  disadvantage  of  this  approach  is  that  taggants  act  as 
contaminants,  and  therefore  may  impede  chemical  processes.  For  this  reason, 
taggants  typically  are  useful  only  in  end  products,  not  in  intermediate  (i.e.,  process) 
chemicals.  Generally,  such  deterrents  appear  to  be  in  the  development  stage  and  are 
not  available  for  immediate  application. 
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Restricted  Access  to  Information.  Restricting  terrorists’  access  to 
information  about  vulnerability  and  location  of  chemical  facilities  also  might  reduce 
the  risk  of  terrorism.  This  approach  was  taken  by  the  106*  Congress  when  it  enacted 
amendments  to  the  CAA  Section  112(r)  to  prevent  Internet  posting  of  risk 
management  plans  and  worst-case  scenarios  for  accidents.  Internet  access  to 
information  is  a  particular  concern,  because  it  permits  anonymous  inquiries  about 
sensitive  U.S.  facilities  from  remote  locations.  P.L.  107-296,  that  established  DHS, 
limits  access  to  sensitive  information  potentially  useful  to  terrorists  by  exempting 
information  about  critical  infrastructures  submitted  voluntarily  to  DHS  from 
disclosure  requirements  of  the  Freedom  of  Information  Act  (FOIA). 

A  key  advantage  of  restricting  access  to  sensitive  information  is  that  it  is  an 
inexpensive  method  of  reducing  risk.  However,  some  argue  that  information 
restriction  is  contrary  to  American  values,  reduces  public  oversight  of  chemical 
facilities  and  consequently  facility  operators’  incentives  to  reduce  risk,  and  is  not 
likely  to  prevent  determined  terrorist  groups  from  obtaining  needed  information.""^ 

The  general  issue  of  public  access  to  facility-specific  information  is  discussed 
under  Key  Issues,  in  the  section  on  Public  Disclosure. 

Key  Issues 

Policy  makers  choosing  among  policy  options  for  reducing  terrorist  risks 
associated  with  chemical  plants  are  faced  with  at  least  three  fundamentally  political 
issues:  the  effect  of  public  disclosure;  the  relative  importance  of  diverse  risks  (and 
associated  costs  and  benefits  of  risk  reduction),  and  who  should  be  responsible  (and 
held  accountable)  for  achieving  results. 

Public  Disclosure.  Public  disclosure  of  information  about  chemical  hazards 
and  risk  management  plans  at  industrial  facilities  is  controversial. ' "  Professional  and 
trade  groups  representing  the  chemical  industry  oppose  the  release  of  information 
regarding  the  vulnerability  of  facilities  to  terrorism  and  the  potential  off-site 
consequences  (OCA)  to  public  health  and  the  environment.  They  argue  that  terrorists 
might  use  the  information  to  target  facilities  that  are  most  vulnerable  or  located  near 
large  population  centers.  Congress  responded  to  this  view  when  it  enacted 
amendments  to  the  CAA  Section  112(r)  in  1999.  The  chemical  industry  and  some 
policy  analysts  support  legislation  that  would  further  restrict  public  disclosure  of  such 
information  and  exempt  it  from  requirements  of  the  Freedom  of  Information  Act 
(FOIA).  (See  “Legislation  in  the  109*  Congress,”  below.)"® 
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Other  groups,  including  environmental  and  right-to-know  advocates,  oppose 
restrictions  on  public  disclosure.  They  argue  that  communities  have  a  right  to  be 
informed  about  hazards  to  which  they  might  be  exposed,  and  that  free  access  to 
information  is  important  to  ensure  public  accountability  of  facility  managers. 
Opponents  of  limiting  public  information  also  point  out  that  citizens  need 
information  to  assess  facility  compliance  with  environmental  laws,  and  if  necessary, 
to  petition  EPA  or  the  courts  for  enforcement.  Unsafe  practices  and  inadequate 
risk  management  plans,  in  particular,  should  be  publicized,  they  contend,  so  that 
communities  may  exert  political  or  social  pressure  on  plant  managers  to  improve  the 
inherent  safety  of  their  facilities.  Moreover,  these  groups  want  access  to  information 
about  similar  facilities  handling  comparable  chemicals  across  the  United  States,  so 
that  plans  and  accident  rates  can  be  compared  and  analyzed  to  determine  the 
effectiveness  of  various  safety  measures.  Informed  citizens  can  work  with  local  plant 
managers  to  reduce  the  risk  of  accidents,  they  argue.  This  view  was  adopted  by 
Congress  in  the  1990  amendments  to  the  CAA  Section  112(r)."* 

A  more  recent  argument  in  favor  of  public  disclosure  has  been  advanced  by 
investment  groups,  who  argue,  “Investors  need  to  know  about  potential  liabilities  of 
companies  in  which  they  invest.”"^  Information  about  risks  related  to  environmental 
issues  frequently  is  not  reported  to  the  Securities  and  Exchange  Commission,  even 
though  it  requires  disclosure  of  trends  and  uncertainties  that  are  reasonably  likely  to 
have  an  impact  on  companies’  profits. 

With  respect  to  the  possibility  that  information  may  be  used  by  terrorists,  right- 
to-know  advocates  claim  that  public  disclosure  of  chemical  hazards  motivates  facility 
operators  to  reduce  chemical  hazards,  thereby  reducing  the  likelihood  and  severity 
of  harm  from  terrorist  attacks,  as  well  as  the  risk  of  chemical  accidents. 

The  net  effect  on  risk  to  public  health  and  the  environment  of  public  disclosure, 
therefore,  appears  to  depend  on  the  relative  risks  of  releases  due  to  accidents,  versus 
those  due  to  terrorism,  and  on  the  extent  to  which  those  risks  are  reduced  or  enhanced 
by  publication  of  risk  management  plans  and  similar  information.  However,  data  are 
not  available  to  calculate  risks,  relative  risks,  or  risk  reduction/enhancement 
potential. 

A  related  issue  is  the  extent  to  which  federal  laws  regarding  public  disclosure 
should  preempt  state  and  local  disclosure  laws.  P.E.  107-296,  establishing  DHS, 
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prohibits  release  under  the  authority  of  state  and  local  disclosure  laws  of 
“information  (including  the  identity  of  the  submitting  person  or  entity)  that  is 
voluntarily  submitted  to  a  covered  Federal  agency  for  use  by  that  agency  regarding 
the  security  of  critical  infrastructure  and  protected  systems.” 

Relative  Risks.  Another  important  issue  involves  the  diverse  and  sometimes 
conflicting  goals  implicit  in  discussions  of  chemical  site  security  enhancement;  there 
is  general  agreement  that  risks  should  be  reduced  and  that  “the  greatest  risks”  should 
be  addressed  first,  but  little  discussion  of  which  risks  are  “greatest”  and  should  be 
targeted  and  at  what  cost.  For  example,  should  we  focus  on  lowering  death  rates  or 
rates  of  sickness  and  disability?  Should  we  focus  on  preventive  measures  or 
emergency  response  and  recovery  services?  Should  we  allocate  resources  to  prevent 
worst-case  scenarios,  or  everyday  risks  that  add  up  over  time?  Are  risks  due  to 
chemical  terrorism  worse  than  risks  of  equal  or  greater  magnitude  due  to  explosions 
or  firearms?  Should  we  emphasize  measures  to  reduce  terrorist  risks  that  also  may 
improve  federal  efforts  to  prepare  for  and  respond  to  other  disasters,  as  the 
President’s  National  Strategy  suggests?'^'  To  what  extent  are  we  willing  to  sacrifice 
access  to  information  about  facilities  in  our  neighborhoods,  privacy,  or  government 
accountability  for  the  sake  of  risk  reduction?  Are  we  willing  to  shift  federal 
resources  to  a  new  Department  of  Homeland  Security  and  away  from  other 
programs?  The  answers  to  such  questions  depend  on  value  judgments  and  are  likely 
to  lead  to  diverse  policy  approaches  and  decisions  about  particular  federal  initiatives 
to  reduce  the  threat  of  terrorism. 

For  example,  on  the  one  hand,  it  often  is  argued  that  federal  expenditures  are 
most  efficient  when  they  are  allocated  with  respect  to  relative  risks  and  risk  reduction 
opportunities.  According  to  this  view,  relatively  more  federal  funding  should  be 
provided  to  programs  targeting  risks  that  are  greater  and  more  clearly  documented 
(e.g.,  to  prevent  smoking  or  motor  vehicle  accidents),  than  for  programs  targeting 
small,  hypothetical  risks  (e.g.,  from  exposure  to  pesticide  residues  on  food).  Based 
on  this  reasoning,  the  risks  of  chemical  terrorism  in  the  United  States  would  deserve 
relatively  few  resources,  because  they  are  hypothetical  and  very  small.  This  is 
especially  true  for  individual  chemical  facilities.  Such  reasoning  might  leave  some 
chemical  facilities  vulnerable  to  attack.  As  explained  by  the  President  of  the 
Louisiana  Chemical  Association,  “Worst-case  scenarios  are  just  that:  Virtually  every 
safety  system  in  every  process  would  have  to  fail  for  a  worst-case  scenario  to  actually 
happen.”^^^  Will  the  federal  government  or  plant  operators  find  such  a  scenario 
incredible,  and  thus,  not  worth  additional  security  investments?  What  cost  is 
justified  for  risk  reduction  at  individual  chemical  facilities? 

On  the  other  hand,  some  have  argued  that  the  distribution  of  risk  is  more 
important  than  the  absolute  or  relative  magnitude  of  risk.  Scholars  at  the  Brookings 
Institution,  for  example,  argue  that  federal  resources  to  combat  terrorism  should  be 
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devoted  primarily  to  avoiding  or  mitigating  potentially  catastrophic  terrorist  acts.'^^ 
Catastrophic  events,  in  which  many  people  are  killed  or  injured  at  once  often  strain 
local  social,  political,  and  economic  systems,  as  well  as  emergency  response 
resources,  as  was  well  illustrated  by  the  attack  on  the  World  Trade  Center.  Thus,  the 
Brookings  report  focuses  on  protecting  against  nuclear,  chemical,  or  biological 
terrorism  and  large-scale  attacks  at  airports,  seaports,  nuclear  and  chemical  plants, 
stadiums,  big  commercial  buildings,  monuments,  and  American  icons,  as  opposed 
to  preventing  numerous  smaller  attacks  that  might  produce  an  equal  number  of 
casualties  over  a  longer  period  of  time.  President  Bush  has  directed  the  DHS 
Secretary  to  set  priorities  for  critical  infrastructure  protection”with  an  emphasis  on 
critical  infrastructure  and  key  resources  that  could  be  exploited  to  cause  catastrophic 
health  effects  or  mass  casualties  comparable  to  those  from  the  use  of  a  weapon  of 
mass  destruction,”  but  with  consideration  of  numerous  other  potential  effects  of 
terrorist  acts. 

Still  others  object  to  reliance  on  any  form  of  cost-benefit  accounting  with 
respect  to  public  health  and  environmental  risk  management,  because  quantitative, 
analytic  tools  often  do  not  consider  risk  factors  and  management  options  that  they 
consider  important. For  example,  one  cannot  produce  a  reliable  estimate  of 
benefits  that  might  accrue  from  basing  decisions  on  the  so-called  “precautionary 
principle”  or  most  other  preventive  management  tools,  because  specific  kinds  of 
damages  and  clean-up  costs  may  never  occur,  and  thus  cannot  be  validated  or 
corrected.  Moreover,  it  can  be  argued  that  quantitative  analysis  is  biased  against 
preventive  measures,  because  the  hypothetical  benefits,  as  well  as  the  hypothetical 
risks,  accrue  (or  not)  in  the  future  and  generally  are  discounted  (reduced  in  value). 
Many  observers  feel  this  kind  of  process  inevitably  estimates  that  preventive  options 
will  have  relatively  high  short-term  costs  and  relatively  low  and  uncertain  long-term 
benefits. 

Responsibility  and  Accountability.  Deciding  who  should  be  responsible 
for  achieving  results  (or  who  should  be  held  accountable)  requires  consideration  of 
many  factors,  including  statutory  authority,  resource  availability,  technical 
competence,  political  feasibility,  and  moral  or  ethical  constraints.  Responsibility  is 
multifaceted,  involving  financial,  operational,  and  managerial  duties,  and  may  be 
layered  hierarchically.  In  addition,  responsibility  may  be  shared  or  distributed  among 
several  private  and  public  entities.  For  example,  in  the  case  of  chemical  plant  safety, 
responsibility  probably  will  be  divided  in  some  manner  to  include  owners/operators 
of  facilities,  insurers,  and  some  unit  of  government.  It  is  up  to  policy  makers  to 
decide  upon  the  appropriate  distribution  of  each  component. 

Generally,  people  agree  that  the  federal  government  is  responsible  for 
protecting  citizens  and  the  homeland,  and  that  business  owners  are  responsible  for 
not  causing  hazards  for  their  employees,  neighbors,  and  assets.  However,  people 
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have  different  views  about  who  should  be  held  accountable  for  the  consequences  of 
an  act  of  terrorism,  what  level  of  protection  from  risk  is  acceptable,  whether  the 
private  sector  is  likely  to  achieve  that  level  of  protection  without  public  assistance 
or  oversight,  and  who  should  bear  the  costs  of  achieving  greater  safety.  These 
different  views  largely  reflect  general  political  philosophies  (e.g.,  regarding  the 
appropriate  role  of  government  and  the  value  of  public  involvement  in  risk 
management  decisions),  but  they  also  are  influenced  by  specific  knowledge  of,  and 
attitudes  toward,  the  chemical  industry,  EPA,  and  other  governmental  and  non¬ 
governmental  entities. 

Some  argue  that  the  risks  of  terrorism  for  individual  chemical  facilities  are  so 
small  that  many  facility  managers  are  unlikely  to  invest  sufficient  resources  to 
adequately  ensure  site  security.  Based  on  this  view,  some  argue  that  sufficient 
reductions  in  terrorist  risks  for  the  nation  as  a  whole  can  be  assured  only  if  chemical 
facilities  are  required  to  comply  with  federal  standards  for  risk  management  —  that 
is,  if  they  are  held  accountable  by  government.  Federally  mandated  standards  are 
likely  to  ensure  a  greater  level  of  safety,  according  to  this  view,  because 
administrative  rule-making  procedures  provide  for  public  comments,  including 
comments  by  people  potentially  at  risk  if  a  terrorist  attacks,  but  who  do  not  directly 
profit  from  neighboring  facilities.  Voluntary  chemical  site  security  measures 
advocated  by  trade  associations  do  not  suffice,  it  is  argued,  because  they  do  not  cover 
all  potentially  dangerous  facilities  and  have  no  standards,  no  timelines,  no  hazard 
reduction  policies,  no  measurable  hazard  reduction  goals,  no  accountability,  and  are 
not  enforceable.'^^  However,  at  least  some  trade  associations  require  independent 
audits  of  risk  management  plans,  as  discussed  below. 

If  Congress  decides  that  the  private  sector  must  be  held  accountable,  legislation 
could  be  enacted  authorizing  EPA  or  the  Department  of  Homeland  Security  to 
conduct  or  oversee  facility  vulnerability  studies  or  to  set  standards  for  facility  risk 
management.  The  Chairman  and  Ranking  Member  of  the  Senate  Committee  on 
Environment  and  Public  Works  in  the  107*  Congress  expressed  a  preference  that 
EPA  lead  such  an  effort, but  the  current  Chairman  of  the  same  Senate  committee 
and  the  Chairman  of  the  House  Committee  on  Energy  and  Commerce  prefer 
leadership  by  the  new  Department. 

Others  contend  that  chemical  facility  operators  are  willing  and  prepared  to 
reduce  significant  risks,  for  personal,  professional,  and  business  reasons.'^*  They 
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argue  that  well-managed  businesses  routinely  assess,  prioritize,  and  manage  risks  of 
all  kinds,  including  risks  of  potential  exposure  to  hazardous  chemicals  due  to 
criminal  or  terrorist  acts.  Business  incentives  to  good  chemical  risk  management 
include  reduced  legal  liability,  reduced  insurance  costs,  enhanced  reputation, 
improved  employee  relations,  and  reduced  costs  for  remediation  and  victim 
compensation.  In  the  United  States,  environmental  and  occupational  health  and 
safety  laws  provide  additional  incentives  to  many  facility  operators  to  responsibly 
manage  hazardous  chemicals. 

Many  are  opposed  to  new  legislation,  which,  they  argue,  may  disrupt  and  delay 
installation  of  security  enhancements  by  individual  companies.  On  the  other  hand, 
if  such  legislation  were  enacted,  it  could  benefit  businesses  by  shifting  liability  to  the 
government  and  discouraging  states  from  adopting  diverse  regulatory  strategies. 

Industry  representatives  acknowledge  that  some  guidance,  training,  and  financial 
assistance  for  threat  assessment  and  risk  management  are  needed,  especially  for 
addressing  risks  to  small  businesses,  but  note  that  trade  associations  and  industrial 
research  centers  have  been  working  for  several  years  to  fill  such  needs.  Such  groups 
advocate  a  flexible,  risk-based  approach  to  securing  facilities,  arguing  that  “most 
plants  are  not  likely  terrorist  targets.”^^^  The  ACC  favors  “public -private 
partnerships  that  allow  industry  to  do  as  much  as  they  can  on  their  own  with  perhaps 
guidance  [from  government].”'^®  Business  groups  argue  that  most  regulations 
inappropriately  force  diverse  enterprises  to  adopt  a  “one-size-fits-all”  strategy.  To 
satisfy  any  public  demand  for  assurance  that  risk  reduction  is  occurring,  some 
industry  representatives  have  recommended  a  safety  certification  process  and  are 
willing  to  submit  their  facilities  to  independent  audits. 

In  the  National  Strategy  for  the  Physical  Protection  of  Critical  Infrastructures 
and  Key  Assets,  released  in  February  2003,  the  Bush  Administration  has 
recommended  legislation  to  enhance  security  measures  at  chemical  facilities,'^' 
although  it  had  hoped  to  avoid  that  approach,  according  to  the  Secretary  of  the 
Department  of  Homeland  Security,  Tom  Ridge. He  acknowledged  that  the 
Administration  (as  of  mid-July,  2002)  had  been  leaning  toward  a  voluntary 
approach. 
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The  Administration  also  would  assign  financial  responsibility  to  chemical 
facility  owners.  According  to  Ridge,  “[T]his  is  a  cost  [chemical  companies]  have  to 
absorb.”  For  their  part,  some  pesticide  trade  groups  would  welcome  increased 
government  assistance  in  the  form  of  funding  for  education. 

Legislation  in  the  109*''  Congress 

Background:  Action  in  the  107*^  Congress.  The  107th  Congress  passed 
the  Public  Health  Security  and  Bioterrorism  Preparedness  and  Response  Act  of  2002 
(P.L.  107-188),  which  requires  many  community  water  systems  to  perform 
vulnerability  assessments  and  to  prepare  emergency  preparedness  and  response  plans. 
Some  of  these  facilities  handle  significant  quantities  of  hazardous  chemicals. 
Funding  is  authorized  to  assist  communities  in  complying  with  the  act.  It  also  directs 
EPA  to  review  methods  to  prevent,  detect,  and  respond  to  threats  to  water  safety  and 
infrastructure  security.  Congress  also  enacted  P.L.  107-117,  which  provides  EPA 
with  roughly  $90  million  to  enhance  the  security  of  drinking  water  treatment 
facilities.  However,  the  107*  Congress  did  not  enact  legislation  to  reduce  risks  of 
terrorism  at  other  facilities  handling  potentially  dangerous  chemicals. 

The  Maritime  Transportation  Security  Act  (MTSA,  P.L.  107-295)  requires  the 
Secretary  of  DHS  to  identify  port  facilities  “that  pose  a  high  risk  of  being  involved 
in  a  transportation  security  incident,”  and  to  conduct  a  vulnerability  assessment  of 
such  facilities.  Eacility  owners  or  operators  are  required  to  develop  and  submit  to 
DHS  both  security  plans  and  incident  response  plans  that  deter  “to  the  maximum 
extent  practicable  a  transportation  security  incident  or  a  substantial  threat  of  such  a 
security  incident”;  are  consistent  with  national  and  area  security  plans;  and  conform 
to  requirements  specified  by  the  U.S.  Coast  Guard.  DHS  must  review  and  approve 
each  plan.  The  act  also  authorized  a  grant  program  that  finances  security  upgrades. 
Eor  more  information  about  the  MTSA  and  related  issues,  see  CRS  Report  RL3 1733, 
Port  and  Maritime  Security:  Background  and  Issues  for  Congress,  by  John  Eritelli. 

P.L.  107-296,  establishing  DHS,  does  not  address  chemical  plant  security 
directly.  However,  the  law  will  require  DHS  to  analyze  vulnerabilities  and 
recommend  methods  of  enhancing  site  security  at  facilities  that  are  part  of  the 
“critical  infrastructure.”  As  noted  above,  the  Administration  has  identified  chemical 
facilities  as  part  of  the  critical  infrastructure  in  the  National  Strategy  for  the  Physical 
Protection  of  Critical  Infrastructures  and  Key  Assets.  Chemical  facilities  are 
included  in  several  sectors:  water  utilities,  the  energy  sector,  and  the  chemical  and 
hazardous  materials  sector.  The  law  exempts  from  public  disclosure  requirements 
(i.e.,  EOIA)  any  information  about  physical  and  cyber  security  if  it  is  submitted 
voluntarily  to  DHS  by  such  facilities  for  use  by  that  agency  related  to  “the  security 
of  critical  infrastructure  and  protected  systems.”  Disclosure  under  the  authority  of 
state  or  local  laws  also  is  prohibited.  Unauthorized  disclosure  of  “critical 
infrastructure  information”  by  government  employees  is  punishable  by  imprisonment, 
fines,  and  removal  from  office. 
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108*^  Congress  Activity.  The  108*  Congress  amended  the  MTSA  in  the 
Coast  Guard  and  Maritime  Transportation  Act  of  2004,  P.L.  108-293,  on  August  9, 
2004.  Title  Vin  of  that  act  requires  the  DHS  to  submit  a  plan  for  a  maritime  security 
grant  program,  including  recommendations  on  how  funds  should  be  allocated. 

No  other  proposals  were  enacted,  although  legislation  addressing  the  risks  of 
terrorism  at  chemical  facilities  was  a  priority  of  the  Chairman  of  the  Senate 
Committee  on  Environment  and  Public  Works,  who  introduced  S.  994,  the  Chemical 
Facility  Security  Act.  S.  994  was  amended  and  reported  by  the  Committee  on  May 
11,  2004.  In  accord  with  the  views  of  the  Bush  Administration,  S.  994  would  have 
authorized  DHS  to  oversee  security  assessments  and  planning  at  selected  chemical 
facilities.  The  Secretary  would  have  been  directed  to  list  chemical  facilities  that 
should  be  subject  to  regulation  based  on:  the  likelihood  that  a  facility  will  be  the 
target  of  terrorism;  nature  and  quantity  of  substances  of  concern  present;  potential 
extent  of  death,  injury,  or  serious  adverse  effects  to  human  health  or  the  environment; 
potential  harm  to  critical  infrastructure  and  national  security;  cost  and  technical 
feasibility;  scale  of  operations;  and  other  security-related  factors  that  the  Secretary 
determines  to  be  appropriate  and  necessary. 

S .  994,  as  reported,  would  have  required  the  Secretary  to  promulgate  regulations 
directing  owners  and  operators  of  listed  facilities  to  conduct  vulnerability 
assessments,  identify  hazards,  prepare  security  plans  to  reduce  vulnerability  to  a 
terrorist  release  and  to  respond  in  the  event  of  a  release,  and  update  assessments  and 
plans  periodically.  Written  certification  of  compliance  would  have  been  required  by 
DHS  from  each  owner  or  operator,  on  a  schedule  to  be  determined  by  the  Secretary. 
As  reported,  S.  994  would  have  required  owners  and  operators  to  submit  copies  of 
vulnerability  assessments  and  plans  to  DHS. 

S.  994  would  have  directed  DHS  to  conduct,  or  required  the  conduct  of, 
vulnerability  assessments  and  other  activities  (including  third-party  audits)  to 
evaluate  and  ensure  compliance  with  promulgated  regulations  and  procedures 
endorsed  by  rule.  (Endorsements  are  discussed  below.)  Vulnerability  assessments 
and  plans  would  have  been  protected  from  public  disclosure  under  EOIA  and  state 
and  local  disclosure  laws.  Criminal  penalties  were  provided  for  unauthorized 
knowing  disclosure  by  federal  officials. 

The  bill  would  have  authorized  the  Secretary  to  identify  and  endorse  security 
measures  that  were  substantially  equivalent  to  requirements  promulgated  by  DHS. 
Endorsement  would  have  indicated  compliance  with  assessment  or  planning 
requirements,  if  the  endorsed  assessment  or  security  procedures  were  implemented. 
Any  person  could  have  petitioned  the  Secretary  for  endorsement  of  existing 
procedures.  If  the  Secretary  chose  not  to  endorse  such  procedures,  the  Secretary 
would  have  to  provide  written  notice  explaining  why  the  petition  was  denied. 
Vulnerability  assessments  and  response  plans  that  were  in  accord  with  endorsed 
procedures  would  have  been  exempt  from  other  regulatory  requirements. 

Although  S.  994,  as  reported,  would  not  have  required  DHS  to  review  and 
approve  assessments  and  plans,  DHS  would  have  been  authorized  to  disapprove  any 
assessment  or  plan,  and  to  order  revision  if  it  did  not  comply  with  regulations,  or  if 
the  plan  or  implementation  were  insufficient  to  address  the  results  of  a  vulnerability 
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assessment  or  a  threat  of  a  terrorist  release.  The  Secretary  would  have  been  required 
to  provide  notice  of  disapproval  explaining  deficiencies,  and  to  identify  appropriate 
steps  to  achieve  compliance.  S.  994  would  have  required  the  Secretary  to  issue  a 
compliance  order  if  a  plan  were  disapproved  and  compliance  had  not  been  achieved 
by  a  date  determined  by  the  Secretary  to  be  appropriate.  Such  orders  would  have 
been  protected  from  public  disclosure.  Civil,  but  not  criminal,  penalties  would  have 
been  available  if  facility  owners  or  operators  failed  to  comply  with  an  administrative 
order.  The  bill  also  would  have  authorized  the  Secretary  to  provide  training  relevant 
to  the  Chemical  Facilities  Security  Act  to  state  and  local  officials  and  facility  owners 
or  operators. 

S.  6,  Title  X,  and  S.  157/H.R.  1861  contained  provisions  similar  to  S.  1602  in 
the  1 07*  Congress .  These  bills  would  have  built  on  existing  EPA  authority  to  oversee 
chemical  facilities,  but  would  have  required  consultation  with  DHS.  They  would 
have  required  EPA  to  designate  “certain  combinations  of  chemical  sources  and 
substances  of  concern”  as  high  priority  categories  based  on  the  severity  of  the  threat 
posed  by  an  unauthorized  release,  proximity  to  population  centers,  and  other  criteria, 
and  to  require  owners  and  operators  of  facilities  within  high  priority  categories  to 
conduct  vulnerability  assessments,  identify  hazards,  and  prepare  prevention, 
preparedness,  and  response  plans  to  eliminate  or  significantly  lessen  the  potential 
consequences  of  an  unauthorized  release.  Plans  would  have  been  required  to 
incorporate  inherently  safer  technology,  if  practicable.  Copies  of  vulnerability 
assessments  and  plans  would  have  been  submitted  to  EPA  and  updated  periodically. 

S.  6  and  S.  157/H.R.  1861  would  have  protected  vulnerability  assessments  and 
plans  from  public  disclosure  under  EOIA,  but  the  non-disclosure  provisions  of  these 
bills  differed  considerably  from  those  in  P.E.  107-296.  Generally,  compared  to  that 
law’s  exemption  from  EOIA  for  voluntarily  submitted  “critical  infrastructure 
information,”  these  Senatebills  (but  notS.  994  norS.  2901,  discussed  below)  appear 
to  have  exempted  a  narrower  range  of  information  from  disclosure  under  EOIA, 
equivalent  to  exemptions  allowed  by  EOIA  itself.  In  addition,  S.  6  and  S.  157/H.R. 
1861  would  have  allowed  disclosure  of  information  under  state  or  local  laws,  if  the 
state  or  local  government  received  the  information  independently  of  DHS .  And  they 
provided  no  civil  liability  immunity  for  those  who  submit  information  nor  criminal 
penalties  for  unauthorized  disclosure.  S.  609/H.R.  2526  would  have  narrowed  the 
EOIA  exemption  provided  by  P.E.  107-296  to  “records”  concerning  the  “vulnerability 
of  and  threats  to  critical  infrastructure  protection.”  Eor  more  on  issues  related  to 
information  disclosure,  see  CRS  Report  RES  1547,  Critical  Infrastructure 
Information  Disclosure  and  Homeland  Security. 

S.  bands.  157/H.R.  1861  would  have  directed  EPA  to  review  each  assessment 
and  plan,  determine  compliance,  and  certify  that  determination.  The  bills  provided 
for  early  review  and  certification  of  assessments  and  plans  submitted  before  EPA 
issued  regulations.  EPA  would  have  been  authorized  to  issue  compliance  orders  30 
days  after  notifying  a  chemical  source  that  its  assessment  or  plan  was  inadequate  and 
offering  compliance  assistance,  if  the  plan  was  not  revised  to  comply  with  EPA 
requirements.  If  DHS  notified  a  chemical  source  that  its  plan  or  implementation  was 
insufficient  to  address  a  threat  of  terrorist  attack,  and  the  chemical  source  took 
inadequate  action  in  response  to  that  notice,  DHS  would  have  been  authorized  to 
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secure  necessary  relief  to  abate  the  threat  from  a  district  court  in  the  district  where 
the  threat  existed. 

For  an  analysis  of  key  differences  and  a  side-by-side  comparison  of  selected 
provisions  of  S.  157/H.R.  1861  and  S.  994  as  introduced,  see  CRS  Report  RL3 1958, 
Chemical  Facility  Security:  A  Comparison  ofS.  157  and  S.  994. 

The  sponsors  of  S.  157  and  S.  994  discussed  various  legislative  provisions  and 
possible  exemptions  for  specific  facilities  throughout  the  108*  Congress,  and  each 
offered  his  bill  as  an  amendment  to  other  legislation.  For  example,  a  modified 
version  of  S.  157  was  introduced  as  an  amendment  (S. Arndt.  462)  to  S.  762,  a  bill 
providing  supplemental  appropriations  for  FY2003.  The  amendment  would  have 
given  DHS  the  lead  role  in  chemical  facility  security.  In  addition,  the  amendment 
would  have  established  a  Technology  Transition  Fund  with  up  to  $50  million  in 
otherwise  unappropriated  funds  from  the  general  Treasury,  to  provide  grants  to 
chemical  facilities  that  demonstrate  financial  hardship  to  assist  them  in  adopting 
inherently  safer  technology.  The  amendment  was  not  brought  to  the  floor  due  to  an 
objection  to  legislating  on  an  appropriation  bill,  a  violation  of  a  Senate  rule. 
Similarly,  Senator  Corzine  and  Senator  Inhofe  submitted  amendments  (S.  Arndt.  3849 
and  S.Amdt.  3946,  respectively)  to  S.  2845,  which  became  P.L.  108-458,  the 
Intelligence  Reform  and  Terrorism  Prevention  Act.  The  amendments  were  ruled 
non-germane  prior  to  final  passage  of  S.  2845. 

Late  in  the  108*  Congress,  the  chairman  of  the  House  Select  Committee  on 
Homeland  Security  introduced  H.R.  5291.  Title  Xn  was  similar  to  S.  157  as 
introduced,  but  would  have  made  DHS  responsible  for  overseeing  chemical  plant 
security,  and  would  have  required  facility  owners  to  give  “full  consideration”  to 
alternative  (inherently  safer)  approaches,  and  to  implement  them  if  “practicable  in  the 
judgment  of  the  owner  or  operator  of  the  chemical  source.”  Security  plans  would 
have  to  be  developed  in  consultation  with  local  law  enforcement  officials  and  first 
responders. 

The  Congressional  Budget  Office  (CBO)  estimated  that  it  would  cost  the  federal 
government  $80  million  over  five  years  to  develop  vulnerability  assessments  and 
monitor  compliance  with  those  assessments  for  the  12,000  to  15,000  chemical  plants 
and  storage  sites  covered  by  S.  1602  (107*  Congress).  (It  is  not  clear  why  CBO 
assumed  that  bill  requirements  would  apply  to  the  entire  universe  of  facilities 
required  to  file  risk  management  plans  under  the  Clean  Air  Act,  rather  than  to  a 
limited  number  of  high-priority  facilities.)  CBO  found  it  difficult  to  estimate  the 
costs  to  the  private  sector,  since  “a  substantial  number”  of  chemical  plants  have 
security  plans  in  place  that  may  partially  or  completely  satisfy  the  assessments 
mandated  by  the  bill.^^^ 

H.R.  2901,  introduced  July  25,  2003,  was  similar  to  S.  994,  as  reported,  with  a 
few  exceptions.  Like  S.  994,  the  House  bill  would  have  made  DHS  the  lead  agency 


U.S.  Congress,  Congressional  Budget  Office,  Cost  Estimate  for  S.  1602,  Chemical 
Security  Act  of 2002,  p.  4. 

[http://www.cbo.gov/showdoc.cfm?index=3840&sequence=0],  visited  Aug.  7,  2003. 


CRS-40 


overseeing  chemical  facility  security,  and  given  the  DHS  Secretary  discretionary 
authority  to  select  facilities  that  should  conduct  vulnerability  assessments  and 
security  planning.  Unlike  S.  994,  H.R.  2901  would  have  exempted  from  its 
requirements  drinking  water  treatment  facilities  required  to  conduct  vulnerability 
assessment  under  the  Safe  Drinking  Water  Act,  unless  the  owner  or  operator  of  such 
a  facility  petitioned  the  Secretary  to  be  subject  to  the  requirements  of  this  act  in  lieu 
of  the  former  act. Both  S.  994  and  H.R.  2901  would  have  focused  assessments  and 
plans  on  security  (i.e.,  hardening)  and  emergency  measures,  in  order  to  prevent  and 
respond  to  releases  caused  by  terrorism,  rather  than  on  inherent  safety  measures  that 
might  reduce  the  consequences  of  an  unauthorized  release,  regardless  of  cause. 

H.R.  2901  would  have  protected  from  public  disclosure  under  FOIA  and  state 
and  local  disclosure  laws  the  certification  documents  submitted  by  facility  managers 
indicating  that  they  have  complied  with  assessment,  planning,  and  implementation 
requirements,  in  addition  to  the  vulnerability  assessments  and  security  plans,  which 
would  be  protected  from  disclosure  under  both  Senate  bills.  Like  S.  994,  H.R.  2901 
also  would  have  withheld  such  information  from  civil  judicial  or  administrative 
proceedings  (except  with  respect  to  compliance  with  the  chemical  facility  security 
legislation),  thus  shielding  facility  owners  from  lawsuits.  Penalties  that  would  have 
been  provided  by  H.R.  2901  for  unauthorized  disclosure  were  the  same  as  under  S. 
994. 


H.R.  2901  would  have  required  the  Secretary  to  endorse  security  measures 
prepared  by  outside  groups  in  response  to  a  petition,  if  the  measures  were 
substantially  similar  to  requirements  promulgated  by  DHS.  S.  994,  as  reported, 
would  have  authorized  rather  than  mandated  DHS  endorsement.  Also  like  S.  994, 
H.R.  2901  would  have  authorized  DHS  to  disapprove  any  assessment  or  plan,  and  to 
order  revision  if  it  did  not  comply  with  regulations,  or  if  the  plan  or  implementation 
were  insufficient  to  address  the  results  of  a  vulnerability  assessment  or  a  threat  of  a 
terrorist  release. 

H.R.  2901  was  similar  to  S.  157/H.R.  1861  and  differed  from  S.  994  in  a  few 
provisions  .H.R.  290 1  would  have  required  consultation  between  DHS  and  EPA,  and 
designation  of  high-priority  facilities. 

Other  legislation  that  was  introduced  but  not  enacted  in  the  108*  Congress 
would  have  provided  financial  assistance  to  state  and  local  governments,  which 
might  have  used  it  to  enhance  chemical  facility  security.  S.  565  and  its  companion 
H.R.  1593  would  have  provided  $10  billion  for  FY2003,  while  S.  87  and  H.R.  1007 
would  have  provided  $14  billion  over  four  years  for  grants  to  state  and  local 
governments  that  could  be  used  to  improve  security  at  chemical  plants,  as  well  as  to 
enhance  emergency  planning  and  responses  to  terrorist  acts.  H.R.  4718  would  have 
provided  a  tax  credit  for  security  expenses  of  retailers  for  agricultural  chemicals.  The 


H.R.  2901  also  would  exempt  “a  chemical  source  that  is  required  to  prepare  a  facility 
vulnerability  assessment  and  a  facility  security  plan  or  emergency  response  plan  under  the 
provision  of  chapter  701  of  title  46,  United  States  Code.”  CRS  could  not  identify  that 
provision. 


CRS-41 


108*  Congress  did  approve  $22  million  for  research  and  development  at  EPA  for 
vulnerability  assessment  methodologies  at  water  treatment  facilities  (P.L.  108-7). 

The  security  of  wastewater  treatment  plants  was  addressed  in  several  bills,  none 
of  which  were  enacted.  S.  779  would  have  required  vulnerability  assessments  and 
emergency  planning  at  plants  serving  at  least  25,000  people,  or  plants  that  EPA 
determines  present  “a  sufficient  security  risk”  to  justify  assessments  and  planning. 
Assessments  and  plans  would  have  been  submitted  to  EPA  and  protected  from  public 
disclosure.  Grants  would  have  been  authorized  to  assist  compliance.  The  bill  would 
have  provided  $180  million  in  PY2004  through  PY2008  to  carry  out  the  program. 
S.  1039,  amended,  was  reported  by  the  Senate  Committee  on  Environment  and 
Public  Works  on  September  17,  2003.  It  was  essentially  the  same  as  House-passed 
H.R.  866.  Both  bills  would  have  authorized  EPA  grants  to  states,  municipalities,  or 
intermunicipal  or  interstate  agencies  to  conduct  vulnerability  assessments  of  publicly 
owned  treatment  works  and  implement  security  enhancements.  Vulnerability 
assessments  would  not  have  been  submitted  to  EPA,  but  grant  applicants  would  have 
been  required  to  certify  that  assessments  had  been  completed,  as  a  condition  of 
receiving  a  grant  for  security  enhancements.  S.  1039/H.R.  866  would  have 
authorized  appropriations  of  $215  million  for  the  program. 

1 09*^  Congress  Activity.  It  is  not  yet  clear  whether  the  109*  Congress  will 
consider  legislation  to  increase  the  security  of  chemical  facilities,  or  even  who  might 
sponsor  legislation.  In  the  Senate,  jurisdiction  over  chemical  facility  security  issues 
may  have  been  shifted,  at  least  in  part,  from  the  Committee  on  Environment  and 
Public  Works  to  the  newly  renamed  Committee  on  Homeland  Security  and 
Governmental  Affairs.  In  the  House,  the  Committee  on  Homeland  Security  has 
become  a  permanent  committee  with  jurisdiction  over  DHS,  but  the  Committee  on 
Energy  and  Commerce  retains  authority  over  chemicals  in  commerce.  Thus, 
committee  jurisdiction  over  legislative  proposals  to  enhance  chemical  facility 
security  also  may  be  reconsidered  in  the  House. 

Conclusions 

The  threat  of  terrorism  in  the  United  States  challenges  the  existing  balance 
maintained  in  federal  laws  between  the  public’s  right  to  know  about  chemical 
hazards  and  the  chemical  industry’s  right  to  protect  confidential  business 
information.  At  issue  are  risks  to  public  health  and  safety,  environmental  protection, 
civil  rights  and  duties,  national  security,  and  privacy.  Some  are  advocating  a  strategy 
of  relative  risk  analysis  and  analysis  of  risk  management  options  to  reveal  the  best 
course  of  action.  However,  information  appears  to  be  inadequate  for  quantitative 
evaluation  of  the  risks  of  chemical  releases,  whether  deliberate  or  accidental,  and  the 
nature  of  terrorism  makes  prediction  difficult.  Moreover,  there  is  no  universally 
accepted  level  of  tolerable  risk,  no  obvious  basis  for  a  comparison  of  relative  risks 
and  benefits,  and  no  established  federal  mechanism  for  ensuring  responsible 
management  of  the  risks  of  chemical  terrorism. 

Policy  makers  face  three  key  issues:  how  to  evaluate  the  risks  versus  the  benefits 
of  public  disclosure;  how  to  determine  and  prioritize  the  relative  importance  of 
diverse  risks;  and  who  to  hold  responsible  for  achieving  results.  Eegislative 
proposals  in  the  108*  Congress  took  a  variety  of  approaches  to  enhance  chemical  site 
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security.  S.  994,  as  reported,  and  H.R.  2901  would  have  authorized  DHS  to  oversee 
security  assessments  and  planning  at  selected  chemical  facilities.  The  Secretary 
would  have  been  directed  to  require  covered  facilities  to  conduct  vulnerability 
assessments,  identify  hazards,  and  prepare  security  plans  to  reduce  vulnerability  to 
a  terrorist  release  and  to  respond  in  the  event  of  a  release.  S.  6,  Title  X,  and  S. 
1 57/H.R.  1861  would  have  built  on  EPA  authority  to  oversee  chemical  facilities.  All 
of  these  bills,  except  S.  994,  would  have  required  DHS  and  EPA  to  designate  “certain 
combinations  of  chemical  sources  and  substances  of  concern”  as  high  priority 
categories.  H.R.  2901  would  have  required  high-priority  facilities  to  submit 
assessments  and  plans  to  DHS.  All  these  bills  would  have  required  owners  and 
operators  of  covered  facilities  to  submit  assessments  and  plans  to  the  relevant  federal 
agency.  S.  6,  S.  157/H.R.  1861,  and  H.R.  5291  also  would  have  required  owners  and 
operators  of  high-priority  facilities  to  reduce  consequences  in  the  event  of  an 
unauthorized  release  of  a  hazardous  chemical,  bunding  for  enhancing  chemical  plant 
security,  for  at  least  some  portion  of  the  universe  of  facilities,  was  included  in  S. 
565/H.R.  1593,  S.  87/H.R.  1007,  and  in  amendments  to  S.  762  and  S.  2845. 
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